CVE-2018-20817: Activision Call Of Duty: Advanced Warfare

Critical severity, CVSS 9.8. EPSS: 3.6% chance of exploitation in the next 30 days.

SV_SteamAuthClient in various Activision Infinity Ward Call of Duty games before 2015-08-11 is missing a size check when reading authBlob data into a buffer, which allows one to execute code on the remote target machine when sending a steam authentication request. This affects Call of Duty: Modern Warfare 2, Call of Duty: Modern Warfare 3, Call of Duty: Ghosts, Call of Duty: Advanced Warfare, Call of Duty: Black Ops 1, and Call of Duty: Black Ops 2.

Affected products

• Activision Call Of Duty: Advanced Warfare: affected versions not specified
• Activision Call Of Duty: Black Ops 1: affected versions not specified
• Activision Call Of Duty: Blacks Ops 2: affected versions not specified
• Activision Call Of Duty: Ghosts: affected versions not specified
• Activision Call Of Duty: Modern Warfare 2: affected versions not specified
• Activision Call Of Duty: Modern Warfare 3: affected versions not specified

Published 2019-04-19. Last modified 2026-06-17.