CVE-2020-15007: Doom Vanille Project Doom Vanille

Critical severity, CVSS 9.8. EPSS: 2.3% chance of exploitation in the next 30 days.

A buffer overflow in the M_LoadDefaults function in m_misc.c in id Tech 1 (aka Doom engine) allows arbitrary code execution via an unsafe usage of fscanf, because it does not limit the number of characters to be read in a format argument.

Affected products

• Doom Vanille Project Doom Vanille: before 671 (fixed in 671)
• Idsoftware Tech 1: affected versions not specified

Published 2020-06-24. Last modified 2026-06-17.