| Title | SteelRaven7 Ravenfield 25407073 Deserialization of Untrusted Data |
|---|
| Description | Ravenfield before September 19th, 2026 has a Deserialization of Untrusted Data vulnerablity which enables 1-click RCE through steam workshop maps.
The developer was contacted and this vulnerablity is patched and resolved as of September 25th, 2026
https://steamcommunity.com/app/636480/eventcomments/590690402783479125
My writeup can be found here: https://drbloop.dev/blog/9-year-old-one-click-remote-code-execution-in-ravenfield
|
|---|
| Source | ⚠️ https://drbloop.dev/blog/9-year-old-one-click-remote-code-execution-in-ravenfield |
|---|
| User | Anonymous User |
|---|
| Submission | 09/26/2026 01:21 (1 month ago) |
|---|
| Moderation | 10/25/2026 08:12 (29 days later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 426166 [SteelRaven7 Ravenfield 25407073 RFL Custom Map Handler/RFLD Custom Map cacheCoverPoints deserialization] |
|---|
| Points | 20 |
|---|