CVE-2017-20205 Details
Description
Valve's Source SDK (source-sdk-2013)'s ragdoll model parsing logic contains a stack-based buffer overflow vulnerability.The tokenizer function `nexttoken` copies characters from an input string into a fixed-size stack buffer without performing bounds checks. When `ParseKeyValue` processes a collisionpair rule longer than the destination buffer (256 bytes), an overflow of the stack buffer `szToken` can occur and overwrite the function return address. A remote attacker can trigger the vulnerable code by supplying a specially crafted ragdoll model which causes the oversized collisionpair rule to be parsed, resulting in remote code execution on affected clients or servers. Valve has addressed this issue in many of their Source games, but independently-developed games must manually apply patch.
A stack-based buffer overflow vulnerability has been identified in Valve's Source SDK 2013. The issue arises in the ragdoll model parsing logic, specifically within the `ParseKeyValue` method of the `CRagdollCollisionRulesParse` class. The vulnerability is triggered by the `nexttoken` function, which copies characters from an input string into a fixed-size stack buffer without proper bounds checking. This flaw allows a remote attacker to supply a specially crafted ragdoll model that includes an oversized `collisionpair` rule, exceeding the buffer limit of 256 bytes. As a result, the stack buffer `szToken` overflows, overwriting the function's return address and enabling remote code execution on affected clients or servers.
Valve has released patches for this vulnerability in several of their Source games, including CS:GO, TF2, Half-Life 2: Deathmatch, Portal 2, and Left 4 Dead 2. However, independently-developed games using the Source SDK 2013 must manually apply the patch. Instructions for applying the patch can be found in the One Up Security advisory.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 15, 2025CISA-ADP
Assessed Oct 15, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/ValveSoftware/source-sdk-2013 | [email protected] | Source CodeVendor |
| https://www.oneupsecurity.com/research/remote-code-execution-in-source-games/ | [email protected] | ExploitRemedy |
| https://www.vulncheck.com/advisories/valve-source-sdk-stack-based-buffer-overflow-rce | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-121 | Stack-based Buffer Overflow | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Valve Source SDK | All versions |
CPE
Remediation
| |
| Valve Counter-Strike: Global Offensive | All versions |
CPE
Remediation
| |
| Valve Team Fortress 2 | All versions |
CPE
Remediation
| |
| Valve Half-Life 2 | All versions |
CPE
Remediation
| |
| Valve Portal 2 | All versions |
CPE
Remediation
| |
| Valve Left 4 Dead 2 | All versions |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Oct 15, 2025 | New CVE Received | [email protected] |