The vulnerability is an uninitialized stack variable in the miniupnpc module of DagorEngine, specifically within upnpreplyparse.C. The improper restriction of operations within the bounds of a memory buffer allows an attacker to write arbitrary data beyond the intended buffer. This buffer overflow can overwrite critical data, potentially enabling remote code execution, privilege escalation, or denial‑of‑service conditions if exploited successfully.

GaijinEntertainment DagorEngine is impacted from the base dagor_2025_01_15 release onward. The affected code resides in the 3rdPartyLibs/miniupnpc component, and versions up to and including dagor_2025_01_15 are vulnerable. No additional product or version information is provided.

The CVSS score of 9.3 classifies this flaw as critical, while the EPSS score of less than 1% indicates a very low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Because the flaw resides in a network‑exposed UPnP module, the likely attack vector is remote over the network, requiring an attacker to send crafted UPnP replies to the vulnerable engine. The description does not state an authentication requirement, so it is inferred that an unauthenticated network attacker could trigger the overflow.