GameMaker CVE-2025-12501

Exploitation requires the target to be a GameMaker project (runtime/IDE below version 2024.14.0) that specifically calls the network_create_server() function and exposes that server to attacker-reachable network traffic; games not using this networking feature are not exposed. Once such a server is running, no authentication or user interaction is needed (PR:N/UI:N), but the practical limiting factors are significant: the affected product must be a networked GameMaker server, must be built on a pre-2024.14.0 runtime, and must be recompiled after patching (updating the IDE alone is insufficient per the advisory). Impact is limited to crashing the server process - no confidentiality or integrity loss.

The signals here are consistent and point to a genuine but bounded availability risk. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5 HIGH) indicates a remotely reachable, low-complexity, unauthenticated flaw with no confidentiality or integrity impact - purely a denial-of-service, which aligns with the CWE-190 integer overflow classification and the 'Denial Of Service' tag. Crucially, the network vector only applies to compiled GameMaker projects that actually invoke network_create_server(); the vulnerability lives in the runtime/IDE below 2024.14.0, not in a universally exposed service, so the real attack surface is far narrower than the AV:N metric alone implies. No EPSS score, no CISA KEV listing, and no public POC are present in the input, so there is no evidence of active or probable exploitation - the 7.5 is a high-severity-ceiling, low-demonstrated-risk issue. The impact is confined to crashing an individual game server process (availability only); there is no code execution or data exposure signal. Net: a legitimate patch-worthy DoS for anyone shipping GameMaker-based multiplayer servers, but not an emergency for the general population, and the headline 'network, unauthenticated' framing should be read against the required use of a specific networking function.

An attacker who can reach a GameMaker-built game server (one using network_create_server()) sends crafted network data that triggers an integer overflow in the server's packet/buffer handling, crashing the process and dropping all connected players. No authentication or user interaction is required once the vulnerable server is listening, but the attacker must be able to connect to a game that actually exposes this function. No public exploit code was identified in the provided data.