CVE-2006-2236: Id Software Quake 3 Arena

High severity, CVSS 7.6. EPSS: 7.6% chance of exploitation in the next 30 days.

Buffer overflow in the Quake 3 Engine, as used by (1) ET 2.60, (2) Return to Castle Wolfenstein 1.41, and (3) Quake III Arena 1.32b allows remote attackers to execute arbitrary commands via a long remapShader command.

Affected products

• Id Software Quake 3 Arena: version 1.32b only
• Id Software Quake 3 Engine: version 1.32b only
• Id Software Return To Castle Wolfenstein: version 1.41 only
• Id Software Wolfenstein Enemy Territory: version 2.60 only

Published 2006-05-08. Last modified 2026-06-16.