CVE-2006-3324: Id Software Quake 3 Engine

Medium severity, CVSS 5.0. EPSS: 4.4% chance of exploitation in the next 30 days.

The Automatic Downloading option in the id3 Quake 3 Engine and the Icculus Quake 3 Engine (ioquake3) before revision 804 allows remote attackers to overwrite arbitrary files in the quake3 directory (fs_homepath cvar) via a long string of filenames, as contained in the neededpaks buffer.

Affected products

• Id Software Quake 3 Engine: any version; version 1.32b only; version 1.32c only; version icculus_803 only; version icculus_804 only

Published 2006-06-30. Last modified 2026-06-16.