The vulnerability exists in Doom Launcher version 3.8.1.0 as a result of missing file path validation during the extraction of game files. An attacker can craft a malicious archive that contains file paths which traverse directories, allowing the extraction routine to write files outside the intended extraction directory. This represents a path traversal weakness, identified as CWE-22, with potential impact of reading or overwriting arbitrary files on the host system.

The only affected product listed in the advisory is Doom Launcher version 3.8.1.0. No vendor or additional version information is provided.

The CVSS base score of 7.5 indicates a high severity vulnerability. The EPSS score of less than 1% suggests that exploitation is unlikely in the wild. This issue is not currently listed in the CISA KEV catalog. The exact attack vector is not detailed in the provided information. It can be inferred that exploitation requires a crafted archive to be processed by the extraction routine; this may occur locally when a user runs the launcher or remotely if untrusted archives are downloaded from a network source. The inference about the delivery method is explicitly noted because the input does not specify it.