Plague Inc Evolved
Monthly
Unsafe deserialization (CWE-502) in the Workshop Scenario Loader of Ndemic Creations' Plague Inc Evolved affects releases up to and including 1.24.0.3, allowing an attacker who can supply a crafted scenario to have it deserialized when the victim loads it. No authentication is required per the CVSS vector (PR:N), but exploitation depends on user interaction (UI:P, passive): the victim must open or subscribe to attacker-supplied Workshop content, so the attacker cannot trigger the flaw unprompted. Impact is bounded to Low confidentiality, integrity and availability per both the vendor-style CVSS 4.0 score of 5.3 and the independent CVSS 3.1 assessment (C:L/I:L/A:L); the CVSS 4.0 Exploit Maturity value of Proof-of-Concept indicates a public PoC reference exists (a third-party blog post is cited), though it is not verified as working exploit code, and there is no CISA KEV listing. Upgrading to 1.24.0.4 is sufficient to fix the issue.
Unsafe deserialization (CWE-502) in the Workshop Scenario Loader of Ndemic Creations' Plague Inc Evolved affects releases up to and including 1.24.0.3, allowing an attacker who can supply a crafted scenario to have it deserialized when the victim loads it. No authentication is required per the CVSS vector (PR:N), but exploitation depends on user interaction (UI:P, passive): the victim must open or subscribe to attacker-supplied Workshop content, so the attacker cannot trigger the flaw unprompted. Impact is bounded to Low confidentiality, integrity and availability per both the vendor-style CVSS 4.0 score of 5.3 and the independent CVSS 3.1 assessment (C:L/I:L/A:L); the CVSS 4.0 Exploit Maturity value of Proof-of-Concept indicates a public PoC reference exists (a third-party blog post is cited), though it is not verified as working exploit code, and there is no CISA KEV listing. Upgrading to 1.24.0.4 is sufficient to fix the issue.