A critical vulnerability in GZDoom versions 4.14.2 and earlier allows local attackers to achieve arbitrary code execution via crafted ZScript actor states.

The flaw exists in the ZScript actor state handling, where improper control of dynamically managed code resources allows scripts to read arbitrary addresses and write constants into JIT-compiled code. An authenticated local user with the ability to execute scripts can manipulate function pointers to redirect control flow and execute attacker-controlled bytecode.

The ability to execute arbitrary code on a system poses a significant security risk, potentially leading to a full system compromise. With a CVSS score of 7.9, this vulnerability is classified as High severity, as it allows an attacker to bypass intended security boundaries and gain control over the application process. While the attack requires local access, the resulting impact on data integrity and system availability is severe.

Immediate Action: Update GZDoom to a version beyond 4.14.2 as specified in the vendor security advisory.

Proactive Monitoring: Monitor system logs for unusual process execution patterns or unexpected script errors originating from the GZDoom engine.

Compensating Controls: Restrict access to the system to authorized users only and ensure that the application is running with the least privilege necessary to limit the potential reach of an exploit.

Public Exploit Available: exploit_available (false)

Given the severity of potential arbitrary code execution, administrators should prioritize updating the GZDoom engine to the latest patched version. Applying this update is the most effective way to eliminate the risk associated with this memory management flaw.