Ravenfield CVE-2026-116098

Exploitation requires the victim to load an attacker-supplied custom map that is processed by Ravenfield's RFL/RFLD Custom Map Handler, whose cacheCoverPoints function deserializes untrusted data (CWE-502). The key limiting factor is user interaction (CVSS UI:P): the attacker cannot trigger this remotely without the player opening/subscribing to and loading the malicious map, so it is a client-side, content-driven attack rather than an unattended network service exploit. No authentication is required (PR:N). The precise trigger mechanics beyond 'manipulation results in deserialization' are not detailed in the available sources.

Signals are moderate but notably conflicting. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P) yields a 5.3 (medium) score driven down by low vulnerable-system impacts (VC:L/VI:L/VA:L), yet the vulnerability class is CWE-502 (deserialization) and one of the references is a blog explicitly titled a 'one-click remote code execution in Ravenfield' - an RCE claim that is hard to reconcile with the low C/I/A metrics assigned by VulDB. This CVSS-vs-reference conflict should be verified: if the deserialization genuinely yields code execution on the player's machine, the real severity is substantially higher than 5.3. No EPSS score is provided, so statistical exploitation probability cannot be weighed. The CVE is NOT listed in CISA KEV, so there is no confirmed active exploitation; the exploitation status is therefore that a public PoC reference (the drbloop.dev write-up) exists but is not verified here as working exploit code. UI:P means successful attack depends on the victim performing an action (loading a custom map), which materially limits mass/automatable exploitation and points toward opportunistic client-side targeting rather than server-side mass compromise. The vuln.today decision label is 'this_month' (not act_now/emergency), consistent with a real but non-emergency priority. Net: treat as a genuine client-side issue worth patching this cycle, but independently verify whether impact is low (as scored) or full RCE (as the reference implies).

An attacker publishes or shares a crafted Ravenfield custom map containing malicious serialized data. When a victim loads that map, the RFL/RFLD Custom Map Handler's cacheCoverPoints function deserializes the attacker-controlled data, triggering the flaw; a public write-up describing this as a one-click RCE exists, though it is not verified here as working exploit code. Because UI:P applies, the victim must actually load the malicious map for the attack to succeed.