CVE-2026-116098

SteelRaven7 Ravenfield RFL Custom Map Handler/RFLD Custom Map cacheCoverPoints deserialization

View on CVE.org
Published Oct 25, 2026 CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Description
A vulnerability was detected in SteelRaven7 Ravenfield 25407073. This vulnerability affects the function cacheCoverPoints of the component RFL Custom Map Handler/RFLD Custom Map Handler. Performing a manipulation results in deserialization. Remote exploitation of the attack is possible. The patch is named EA39 Security Patch. Applying a patch is the recommended action to fix this issue.

Analysis

AI-generated

Technical impact

An attacker can manipulate the "cacheCoverPoints" function of RFL Custom Map Handler/RFLD Custom Map Handler, which triggers unsafe deserialization of data supplied to the game. The vulnerability is a combination of insecure input validation and improper deserialization, allowing execution of arbitrary code once a crafted payload is processed.

Affected Systems

SteelRaven7’s game Ravenfield is affected, specifically version 25407073. The flaw resides in the custom map handling components that process user supplied map data.

Risk and Exploitability

The CVSS score of 5.3 indicates a moderate severity threat. Although the EPSS score is not available and the issue is not listed in the KEV catalog, the description confirms that remote exploitation is possible, making the risk tangible for systems that accept arbitrary custom maps from untrusted sources.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the EA39 Security Patch to update Ravenfield to a version that fixes the deserialization flaw
  • Disable or restrict the RFL Custom Map Handler for users who are not explicitly trusted if custom map upload is not required
  • Monitor system logs for abnormal custom map loading activity to detect potential exploitation attempts

Generated by OpenCVE AI on October 26, 2026 at 00:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
CPEs cpe:2.3:a:steelraven7:ravenfield:*:*:*:*:*:steam:*:*
Type Values Removed Values Added
Description A vulnerability was detected in SteelRaven7 Ravenfield 25407073. This vulnerability affects the function cacheCoverPoints of the component RFL Custom Map Handler/RFLD Custom Map Handler. Performing a manipulation results in deserialization. Remote exploitation of the attack is possible. The patch is named EA39 Security Patch. Applying a patch is the recommended action to fix this issue.
Title SteelRaven7 Ravenfield RFL Custom Map Handler/RFLD Custom Map cacheCoverPoints deserialization
First Time appeared Steelraven7
Steelraven7 ravenfield
Weaknesses CWE-20
CWE-502
CPEs cpe:2.3:a:steelraven7:ravenfield:*:*:*:*:*:*:*:*
Vendors & Products Steelraven7
Steelraven7 ravenfield
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:ND/RL:OF/RC:C'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X'}
Weaknesses
  • CWE-20

    Improper Input Validation

  • CWE-502

    Deserialization of Untrusted Data

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Oct 29, 2026, 4:28 PM
Reserved
Oct 25, 2026, 7:12 AM

View source JSON

Updated
Oct 29, 2026, 4:28 PM

JSON

Status
Analyzed
Published
Oct 26, 2026, 12:17 AM
Modified
Oct 29, 2026, 5:18 PM

View source JSON

No data.

Updated
Oct 26, 2026, 6:52 PM

JSON