EUVD-2026-109580
GHSA-2424-3jrj-v5gr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim into malicious multiplayer session
-
DeliveryDeliver crafted BlitzBanks input
-
ExploitTrigger out-of-bounds write in Skynet++ VM
-
ExecutionCorrupt memory / execute attacker-controlled code
-
ImpactCompromise victim's game client
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a victim running a vulnerable client (version up to 1.295) who connects to or interacts with an attacker-controlled multiplayer session; the crafted input must reach the BlitzBanks function in the Skynet++ virtual machine component. The CVSS UI:P metric and the 'one-click' write-up indicate the victim must take an action (such as joining a game/server), which limits mass, fully-unattended exploitation. The flaw is remediated in version 1.3R, so patched clients are not exploitable; the vendor states upgrading is the recommended remediation. The precise byte-level trigger within BlitzBanks is not described in the available sources. |
| Impact | Signals are mixed and point to a LOW operational priority for most organizations, with one notable discrepancy. The official CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L, base 2.1) describes a remote, low-complexity, unauthenticated flaw that nonetheless requires passive user interaction (UI:P) and yields only LOW impact to confidentiality, integrity and availability with no scope change. The vuln.today decision label is 'monitor' (not act_now/emergency), and no EPSS score and no CISA KEV entry were provided, so there is no evidence of widespread or active exploitation. However, the exploitation status E:P (Proof-of-Concept) plus a published GitHub repository and a write-up titled 'one-click remote code execution' conflict sharply with the LOW CVSS impact metrics: a blog claiming RCE against a CWE-119 out-of-bounds write is inconsistent with VC:L/VI:L/VA:L. This discrepancy should be verified - if the 'one-click RCE' claim is accurate, the true impact (and score) is materially higher than the 2.1 base suggests. Set against this, the affected asset is a consumer indie multiplayer game (SCP: Containment Breach Multiplayer), not enterprise software, so real-world organizational exposure is minimal even if a working exploit exists. |
| Exploit ScenarioDerived | An attacker hosts or joins a multiplayer session and sends crafted data that reaches the BlitzBanks function inside the game's embedded Skynet++ virtual machine, triggering an out-of-bounds write when a victim client connects or interacts (UI:P / 'one-click'). A public PoC/exploit reference is published on GitHub and the CVE description states the exploit has been published, so the barrier to reproduction is low, though the official score rates the resulting impact as low. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 26, 2026
Out-of-bounds write in SCP: Containment Breach Multiplayer's Skynet++ virtual machine allows remote attackers to corrupt memory when a victim running versions up to 1.295 joins or interacts with a crafted multiplayer session. The flaw is in the BlitzBanks function, is fixed in version 1.3R, and publicly available exploit code exists; no CISA KEV confirmation is present in the supplied data. The CVSS 4.0 record scores it 2.1 with UI:P, while the independent CVSS 3.1 assessment is 8.8 because successful exploitation can fully compromise confidentiality, integrity, and availability on the client.
RemediationAI
Vendor-released patch: 1.3R. Upgrade SCP Containment Breach Multiplayer to version 1.3R or later; the vendor states this is the remediation and the Steam patch notes and news item document the release (https://steamdb.info/patchnotes/25701366/ and https://store.steampowered.com/news/app/1782380/view/670629296167978253). Until every client is upgraded, exposure is reduced by not joining or interacting with untrusted multiplayer sessions, because exploitation requires the victim to connect to an attacker-controlled session and reach BlitzBanks in the Skynet++ VM; this is a compensating restriction, not a complete fix, and it limits normal multiplayer play. No other vendor-sanctioned workaround is described in the supplied data, and the VulDB advisory is at https://vuldb.com/vuln/426167.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-119 (improper restriction of operations within the bounds of a memory buffer) covers the out-of-bounds write reported in the BlitzBanks function of the Skynet++ virtual machine used by SCP: Containment Breach Multiplayer. The supplied CVSS 4.0 vector is AV:N/AC:L/AT:N/PR:N/UI:P with low C/I/A impacts, while the independent CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H; both agree the issue is remotely reachable and requires a user action, but they diverge on impact severity. The exact byte-level trigger inside BlitzBanks is not described in the available sources, and no CPE strings were supplied; the confirmed affected range is up to 1.295, with 1.3R as the fixed release.
Know when Scp gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Remote unauthenticated OOB write reached only when a victim joins a session (UI:R, PR:N, AV:N/AC:L); impacts set High to reflect the published 'one-click RCE' claim, which exceeds the input's low impact metrics.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
DescriptionCVE.org
A flaw has been found in Fusion Creators Studio SCP Containment Breach Multiplayer up to 1.295. This issue affects the function BlitzBanks of the component Skynet++ Virtual Machine. Executing a manipulation can lead to out-of-bounds write. The attack can be executed remotely. The exploit has been published and may be used. Upgrading to version 1.3R is capable of addressing this issue. It is recommended to upgrade the affected component.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Exploit-DB