Skip to content
BackEsc
Sign in

Valve · disclosed reports

Memory Corruption

28 disclosed reports · $75,150 paid

Out of date: the sync last ran 5 hours ago. Newer CVEs and scores may be missing from the map.

Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. Reports open on HackerOne.

Open Valve on HackerOne
reports
28
paid a bounty
18

Every one of the 28 is a mark on the map. Named now: 1 to 26, most upvoted first.

  1. RCE on Steam Client via buffer overflow in Server Info#470520Valve · 1,289 votes
  2. Malformed .BMP file in Counter-Strike 1.6 may cause shellcode injection#397545Valve · 321 votes
  3. Malformed NAV file leads to buffer overflow and code execution in Left4Dead2.exe#542180Valve · $10,000 · 268 votes
  4. Unchecked weapon id in WeaponList message parser on client leads to RCE#513154Valve · $3,000 · 229 votes
  5. OOB reads in network message handlers leads to RCE#807772Valve · $7,500 · 219 votes
  6. RCE on CS:GO client using unsanitized entity ID in EntityMsg message#584603Valve · $9,000 · 209 votes
  7. Buffer overrun in Steam SILK voice decoder#1180252Valve · $7,500 · 196 votes
  8. [Portal 2] Remote Code Execution via voice packets#733267Valve · $5,000 · 173 votes
  9. [Half-Life 1] Malformed map name leads to memory corruption and code execution#402566Valve · $1,500 · 163 votes
  10. Malformed .BSP Access Violation in CS:GO can lead to Remote Code Execution#351014Valve · 154 votes
  11. Specially Crafted Closed Captions File can lead to Remote Code Execution in CS:GO and other Source Games#463286Valve · $7,500 · 109 votes
  12. Malformed .MDL triggers an Access Violation on GoldSRC (hl.exe)#495793Valve · 90 votes
  13. [steam client] Opening a specific steam:// url overwrites files at an arbitrary location#667242Valve · $750 · 80 votes
  14. CS:GO Server -> Client RCE through OOB access in CSVCMsg_SplitScreen + Info leak in HTTP download#1070835Valve · $7,500 · 66 votes
  15. Malformed playlist.txt in GoldSrc games leads to Access Violation & arbitrary code execution#504951Valve · $1,000 · 62 votes
  16. Buffer overflow In hl.exe's launch -game argument allows an attacker to execute arbitrary code locally or from browser#832750Valve · 55 votes
  17. [CS:GO] Unchecked texture file name with TEXTUREFLAGS_DEPTHRENDERTARGET can lead to Remote Code Execution#550625Valve · $2,500 · 48 votes
  18. Signedness issue in ClassInfo message handler leads to RCE on CS:GO client#876719Valve · $7,500 · 35 votes
  19. Buffer overflows in demo parsing#350119Valve · 33 votes
  20. Malformed map detailed texture files in GoldSrc games lead to Remote Code Execution#505173Valve · $350 · 30 votes
  21. Malformed Skybox .TGA in Half-Life (GoldSRC) leads to Access Violation#351016Valve · 30 votes
  22. GoldSrc: Buffer Overflow in DELTA_ParseDelta function leads to RCE#484745Valve · $3,000 · 26 votes
  23. [GoldSrc] RCE via malformed BSP file#763403Valve · $450 · 24 votes
  24. [GoldSrc] RCE via 'spk' Console Command#769014Valve · $350 · 23 votes
  25. Malformed BSP in GoldSrc Engine may cause shellcode injection#458929Valve · 21 votes
  26. Potential buffer overflow in demoplayer module of GoldSource Engine#440758Valve · 17 votes

paid a bounty

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.

CyberSIXTSignal over noise
Updated AboutDevelopersSign in