CVE-2026-4750: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-4750 is an Out-of-bounds Read vulnerability (CWE-125) in fabiangreffrath/woof, a Doom source port, affecting all versions before woof_15.3.0. The vulnerability originates in src/m_scanner.c, which was cloned from GNUAspell/aspell but did not receive the security patch originally applied under CVE-2019-17544. It was discovered by a security tool, reported via GitHub pull request on December 19, 2025, merged on December 27, 2025, and assigned CVE-2026-4750 on March 24, 2026. The CVSS v3.1 base score is 9.1 (Critical) (GitHub PR #2521, ENISA EUVD).

The root cause is an out-of-bounds read (CWE-125) in the Unescape() function within src/m_scanner.c, which fails to properly handle a trailing backslash at the end of a string — allowing a read beyond the allocated buffer boundary. This code was cloned from GNUAspell/aspell (and originally from ZDoom 2.8.1) without incorporating the fix that GNUAspell applied for CVE-2019-17544. The same vulnerable function was also identified in DSDA-Doom and Odamex, both of which received separate fixes. The attack vector is network-based with low complexity and requires no authentication or user interaction, per the CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H (GitHub PR #2521, ENISA EUVD).

Successful exploitation can result in unauthorized disclosure of sensitive memory contents (high confidentiality impact) and application crashes leading to denial of service (high availability impact). Integrity is not directly affected. Because no authentication is required and the attack vector is network-accessible, a remote unauthenticated attacker could trigger the vulnerability to extract in-memory data or crash the woof process (ENISA EUVD, Feedly).

As of the time of reporting, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Feedly). The EPSS score is approximately 0.043%, indicating a low current probability of exploitation in the wild. No threat actor attribution has been made, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. A Nessus detection plugin (ID 303483) is available for identifying vulnerable instances (Tenable Nessus).

The fix was merged into the fabiangreffrath/woof master branch on December 27, 2025 (commit 22f7572), and is included in woof version 15.3.0 and later. Users should upgrade to woof_15.3.0 or newer immediately. If immediate patching is not feasible, restrict network access to any services exposing woof functionality. The Debian maintainer (carnil) indicated a DSA is not warranted but plans to push the fix to stable and oldstable Debian series. Parallel fixes were also applied to DSDA-Doom (kraflab/dsda-doom#823) and Odamex (odamex/odamex#1520) (GitHub PR #2521).

The woof project owner (fabiangreffrath) acknowledged the fix as "reasonable" and noted that the project is not the origin of the vulnerable code, pointing out it traces back to ZDoom 2.8.1. A collaborator (rfomin) identified the same issue in DSDA-Doom and Odamex, prompting coordinated fixes across multiple Doom source ports. The Debian security team (carnil) confirmed the CVE assignment and indicated a stable-series fix would be pursued without a formal DSA. Discussion was limited to the GitHub pull request thread with no significant broader media coverage (GitHub PR #2521).