Plague Inc Evolved EUVD-2026-109638

Exploitation requires a victim running Plague Inc Evolved up to version 1.24.0.3 to load attacker-supplied content through the Workshop Scenario Loader component, which then performs unsafe deserialization (CWE-502). The limiting factor is the required user interaction (UI:P in the CVSS 4.0 vector): the attacker cannot trigger the flaw unprompted and must get the victim to load a malicious Workshop scenario (e.g. via a subscribed/opened custom scenario). No authentication is required (PR:N). Exploitation is bounded to affected versions; upgrading to 1.24.0.4 fully fixes the issue per the vendor. How the deserialization is reached internally is not described in the available sources, and whether it yields code execution versus the vendor-rated Low impact is unverified.

This is a medium-severity (CVSS 4.0 base 5.3) deserialization flaw (CWE-502) in the Workshop Scenario Loader of Plague Inc Evolved. The input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P) indicates remote, unauthenticated, low-complexity reach but requires passive user interaction - the victim must load attacker-supplied Workshop content - and the vendor rated impact as Low across confidentiality, integrity and availability (VC:L/VI:L/VA:L). There is a notable signal conflict: the vendor's CVSS caps impact at Low, while the referenced public write-up is titled 'one-click RCE', implying code execution; this discrepancy is unresolved in the available data and should be treated as unverified rather than confirmed. No EPSS score and no KEV status are provided in the input, so there is no quantitative exploitation-probability or active-exploitation signal; the vuln.today priority is 'this_month' (not act_now/emergency). The E:P exploit-maturity metric and the drbloop.dev reference indicate a public PoC reference exists, but it is not verified as working exploit code. Overall this reads as a genuine but moderate-priority client-side issue gated by user interaction, not a widescale unauthenticated server compromise; the main uncertainty is whether real impact is Low (per vendor) or full RCE (per the unverified blog), which materially changes prioritization and should be confirmed with the vendor.

An attacker publishes a malicious custom scenario to the Steam Workshop; when a victim subscribes to and loads it through the Workshop Scenario Loader, the game unsafely deserializes attacker-controlled data (CWE-502), triggering the vulnerability on the victim's client. A public PoC reference exists (the drbloop.dev 'one-click RCE' write-up) but it is not verified as working exploit code, and the vendor's CVSS rates impact only as Low, so the realistic outcome ranges from limited client-side compromise to the code execution the blog claims - unconfirmed in the available data. Exploitation requires the victim to load the crafted Workshop item (UI:P).