{"id":"CVE-2026-116098","kind":"vulnerability","aliases":["CVE-2026-116098"],"related":[],"title":"Ravenfield: map handler deserialization flaw allows remote exploitation","description":"A vulnerability was detected in SteelRaven7 Ravenfield 25407073. This vulnerability affects the function cacheCoverPoints of the component RFL Custom Map Handler/RFLD Custom Map Handler. Performing a manipulation results in deserialization. Remote exploitation of the attack is possible. The patch is named EA39 Security Patch. Applying a patch is the recommended action to fix this issue.","summary":"Ravenfield's loader for custom maps (.rfl/.rfld, e.g. Steam Workshop) deserializes untrusted data in cacheCoverPoints. The developer describes it as remote code execution on loading a malicious map, present since modded maps were introduced. The developer fixed it on Sep 19 2026 and says it has no reports or indication of exploitation. The researcher blog title calls it one-click RCE. Legacy branches were removed because they are unpatched.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Ravenfield","fixed":["EA39 Security Patch (Sep 19 2026); current public build 25532209"],"affected":"build 25407073 and earlier builds before the Sep 19 2026 EA39 Security Patch","ecosystem":"vendor"}],"ecosystems":[],"tags":["custom-maps","deserialization","game","game-server","other","ravenfield","rce","steam","workshop"],"not_affected_if":["no-custom-maps","patched-ea39","rfcs-content-mods-only"],"how_to_check":"Check your Ravenfield install is on the current public Steam build, which is 25532209 or later (the EA39 Security Patch of Sep 19 and the Sep 25 follow-up). Build 25407073 is listed as vulnerable. Do not load custom maps from Workshop or other sources on older builds or on a legacy branch.","fix":"Update Ravenfield through Steam to the current public build (EA39 Security Patch, Sep 19 2026; build 25532209 includes it). Legacy branches are unpatched and were removed, so move off them.","status":"open","published_at":"2026-10-26T00:17:14+00:00","first_seen_at":"2026-10-26T00:38:41+00:00","triaged_at":"2026-10-26T00:40:31+00:00","updated_at":"2026-10-26T00:41:12+00:00","category":"other","confidence":0.75,"triage":{"at":"2026-10-26T00:40:31Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the EA39 Security Patch to Ravenfield, per the NVD entry's recommendation.","reach":"unknown","title":"Ravenfield: map handler deserialization flaw allows remote exploitation","impact":"high","summary":"Ravenfield build 25407073 has a deserialization flaw in the cacheCoverPoints function of its custom map handler, which can be triggered remotely. The sources do not say what an attacker can run or read after triggering it.","category":"other","nicknames":[],"who_cares":["ravenfield","game-server","custom-maps"],"confidence":0.4,"needs_auth":"unknown","worst_case":"unknown: sources do not say what code or data an attacker reaches","analyst_note":"Check the NVD entry and the vendor's EA39 patch notes to confirm the attack path, the required setup, and what the deserialization gives an attacker.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Teams running SteelRaven7 Ravenfield build 25407073 with the RFL/RFLD custom map handler in use. The sources do not say whether the flaw needs a server, a shared map feed, or only a local game client, so whether a given install is reachable is unknown.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00057,"input_tokens":3347,"output_tokens":470,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the NVD entry and the vendor's EA39 patch notes to confirm the attack path, the required setup, and what the deserialization gives an attacker.","search":"'-116098':11A,14A '-2026':10A,13A '19':69B '2026':70B '25407073':106C 'action':149C 'affect':109C 'allow':6A 'appli':143C 'attack':133C 'blog':83B 'branch':92B 'cachecoverpoint':43B,112C 'call':85B 'click':89B 'code':50B 'compon':115C 'custom':17B,33B,117C,120C 'custom-map':16B 'cve':9A,12A 'data':41B 'describ':46B 'deseri':4A,19B,39B,128C 'detect':102C 'develop':45B,64B 'e.g':36B 'ea39':140C 'execut':51B 'exploit':8A,80B,130C 'fix':65B,151C 'flaw':5A 'function':111C 'game':20B,22B 'game-serv':21B 'handler':3A,122C 'handler/rfld':119C 'indic':78B 'introduc':62B 'issu':153C 'legaci':91B 'load':53B 'loader':31B 'malici':55B 'manipul':125C 'map':2A,18B,34B,56B,60B,118C,121C 'mod':59B 'name':139C 'one':88B 'one-click':87B 'patch':137C,142C,145C 'perform':123C 'possibl':135C 'present':57B 'ravenfield':1A,15A,25B,29B,105C 'rce':26B,90B 'recommend':148C 'remot':7A,49B,129C 'remov':94B 'report':76B 'research':82B 'result':126C 'rfl':116C 'rfl/.rfld':35B 'say':72B 'secur':141C 'sep':68B 'server':23B 'sinc':58B 'steam':27B,37B 'steelraven7':104C 'titl':84B 'unpatch':98B 'untrust':40B 'vulner':100C,108C 'workshop':28B,38B","nicknames":[],"mitigations":[],"who_affected":"Teams running SteelRaven7 Ravenfield build 25407073 with the RFL/RFLD custom map handler in use. The sources do not say whether the flaw needs a server, a shared map feed, or only a local game client, so whether a given install is reachable is unknown.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T00:17:14+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116098","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116098","severity":null,"published_at":"2026-10-26T00:17:14+00:00","modified_at":"2026-10-26T00:17:14+00:00","first_seen_at":"2026-10-26T00:38:41+00:00","fetched_at":"2026-10-26T00:38:41+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-116098:823","url":null,"severity":null,"published_at":"2026-10-26T00:41:12+00:00","modified_at":"2026-10-26T00:41:12+00:00","first_seen_at":"2026-10-26T00:41:12+00:00","fetched_at":"2026-10-26T00:41:12+00:00","note":"NVD (VulDB CNA, CVSS4 5.3) plus developer EA39 Security Patch notes (read via SteamPeaks mirror, not Steam directly): RCE when loading custom rfl/rfld maps, fixed Sep 19 2026, no known exploitation, no public PoC found; researcher blog (drbloop.dev) body did not load. Nothing marked verified because vendor text was read via a mirror."}],"documents":[{"id":3660,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116098","title":"NVD CVE-2026-116098","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":3661,"url":"https://steampeaks.com/patchnotes/25532209","title":"Ravenfield EA39 Security Patch notes (developer post, mirrored)","kind":"vendor","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":3662,"url":"https://drbloop.dev/blog/9-year-old-one-click-remote-code-execution-in-ravenfield","title":"9-Year Old One-Click Remote Code Execution in Ravenfield (title only; page body did not load)","kind":"blog","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}