---
id: "CVE-2026-116098"
kind: "vulnerability"
aliases: ["CVE-2026-116098"]
title: "Ravenfield: map handler deserialization flaw allows remote exploitation"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "Ravenfield", "fixed": ["EA39 Security Patch (Sep 19 2026); current public build 25532209"], "affected": "build 25407073 and earlier builds before the Sep 19 2026 EA39 Security Patch", "ecosystem": "vendor"}]
ecosystems: []
tags: ["custom-maps", "deserialization", "game", "game-server", "other", "ravenfield", "rce", "steam", "workshop"]
not_affected_if: ["no-custom-maps", "patched-ea39", "rfcs-content-mods-only"]
published_at: "2026-10-26T00:17:14+00:00"
first_seen_at: "2026-10-26T00:38:41+00:00"
updated_at: "2026-10-26T00:41:12+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116098", "first_seen_at": "2026-10-26T00:38:41+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-26T00:41:12+00:00"}]
---

# Ravenfield: map handler deserialization flaw allows remote exploitation

Ravenfield's loader for custom maps (.rfl/.rfld, e.g. Steam Workshop) deserializes untrusted data in cacheCoverPoints. The developer describes it as remote code execution on loading a malicious map, present since modded maps were introduced. The developer fixed it on Sep 19 2026 and says it has no reports or indication of exploitation. The researcher blog title calls it one-click RCE. Legacy branches were removed because they are unpatched.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Ravenfield affected build 25407073 and earlier builds before the Sep 19 2026 EA39 Security Patch fixed EA39 Security Patch (Sep 19 2026); current public build 25532209

## How to check

Check your Ravenfield install is on the current public Steam build, which is 25532209 or later (the EA39 Security Patch of Sep 19 and the Sep 25 follow-up). Build 25407073 is listed as vulnerable. Do not load custom maps from Workshop or other sources on older builds or on a legacy branch.

## Fix

Update Ravenfield through Steam to the current public build (EA39 Security Patch, Sep 19 2026; build 25532209 includes it). Legacy branches are unpatched and were removed, so move off them.

## Timeline

- 2026-10-26T00:38:41+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116098
- 2026-10-26T00:41:12+00:00 analyst — NVD (VulDB CNA, CVSS4 5.3) plus developer EA39 Security Patch notes (read via SteamPeaks mirror, not Steam directly): RCE when loading custom rfl/rfld maps, fixed Sep 19 2026, no known exploitation, no public PoC found; researcher blog (drbloop.dev) body did not load. Nothing marked verified because vendor text was read via a mirror.

## Documents

- [advisory] NVD CVE-2026-116098 https://nvd.nist.gov/vuln/detail/CVE-2026-116098
- [describes] 9-Year Old One-Click Remote Code Execution in Ravenfield (title only; page body did not load) https://drbloop.dev/blog/9-year-old-one-click-remote-code-execution-in-ravenfield
- [fix] Ravenfield EA39 Security Patch notes (developer post, mirrored) https://steampeaks.com/patchnotes/25532209

## From the sources

A vulnerability was detected in SteelRaven7 Ravenfield 25407073. This vulnerability affects the function cacheCoverPoints of the component RFL Custom Map Handler/RFLD Custom Map Handler. Performing a manipulation results in deserialization. Remote exploitation of the attack is possible. The patch is named EA39 Security Patch. Applying a patch is the recommended action to fix this issue.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_