{"id":"CVE-2020-6018","details":"Valve's Game Networking Sockets prior to version v1.2.0 improperly handles long encrypted messages in function AES_GCM_DecryptContext::Decrypt() when compiled using libsodium, leading to a Stack-Based Buffer Overflow and resulting in a memory corruption and possibly even a remote code execution.","modified":"2026-07-08T20:43:19.168076Z","published":"2020-12-02T01:15:12.967Z","references":[{"type":"FIX","url":"https://github.com/ValveSoftware/GameNetworkingSockets/commit/bea84e2844b647532a9b7fbc3a6a8989d66e49e3"},{"type":"EVIDENCE","url":"https://research.checkpoint.com/2020/game-on-finding-vulnerabilities-in-valves-steam-sockets/"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/valvesoftware/gamenetworkingsockets","events":[{"introduced":"0"},{"fixed":"5fe10494e27be722d18c443dc70f851541e5d554"},{"fixed":"bea84e2844b647532a9b7fbc3a6a8989d66e49e3"}],"database_specific":{"cpe":"cpe:2.3:a:valvesoftware:game_networking_sockets:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"1.2.0"}],"source":["CPE_RANGE","REFERENCES"]}}],"versions":["v1.1.0","1.0.0"],"database_specific":{"vanir_signatures_modified":"2026-07-08T20:43:19Z","vanir_signatures":[{"signature_version":"v1","source":"https://github.com/valvesoftware/gamenetworkingsockets/commit/bea84e2844b647532a9b7fbc3a6a8989d66e49e3","target":{"file":"src/common/crypto_libsodium.cpp"},"deprecated":false,"digest":{"line_hashes":["52691826167457112983503260961091026559","59204750815037251694094423752510544309","279076421485059480042245693453961181727","88392938568156394113758394813796740600","148307562868202614789858736052206955465","62974124456999014022672169008229187834","39856459862302572172127681122008364988","283902811648819916949251177167661882745","167214140082607794366283767026040314558","154240327021194259080724312047976054","17318550766505549032601864229319008504","80376689745879336645902742434551085576","120477275188369119011041291152099845779","330309891247341019875152988578956994517","27498847957549980932223577273222385510","131492568894440567065655225415270919179","123598239998409716657833016213004277998","109336286601377474600046040659048862700","23305926315217028414810524080729230449","46319120820134205357889291891654997610","324868010669695469711659417035132498495","279362571597481890134149311276467041918"],"threshold":0.9},"id":"CVE-2020-6018-702ebceb","signature_type":"Line"},{"deprecated":false,"digest":{"length":519,"function_hash":"252413261951960031412694176005296652096"},"id":"CVE-2020-6018-cb20f4a0","signature_type":"Function","signature_version":"v1","source":"https://github.com/valvesoftware/gamenetworkingsockets/commit/bea84e2844b647532a9b7fbc3a6a8989d66e49e3","target":{"file":"src/common/crypto_libsodium.cpp","function":"AES_GCM_EncryptContext::Encrypt"}},{"digest":{"function_hash":"309241837407405954771850089554763267213","length":531},"id":"CVE-2020-6018-ee7d52df","signature_type":"Function","signature_version":"v1","source":"https://github.com/valvesoftware/gamenetworkingsockets/commit/bea84e2844b647532a9b7fbc3a6a8989d66e49e3","target":{"file":"src/common/crypto_libsodium.cpp","function":"AES_GCM_DecryptContext::Decrypt"},"deprecated":false}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-6018.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}