CVE-2006-2875: Id Software Quake 3 Engine

High severity, CVSS 7.5. EPSS: 6.8% chance of exploitation in the next 30 days.

Stack-based buffer overflow in the CL_ParseDownload function of Quake 3 Engine 1.32c and earlier, as used in multiple products, allows remote attackers to execute arbitrary code via a svc_download command with compressed data that triggers the overflow during expansion.

Affected products

• Id Software Quake 3 Engine: up to and including 1.32c

Published 2006-06-07. Last modified 2026-06-16.