CS:GO: FROM ZERO TO 0-DAY

Summary from the TLDR Web Dev newsletter

Neodyme identified three independent remote code execution (RCE) vulnerabilities in the popular Counter-Strike: Global Offensive game. Each vulnerability can be triggered when the game client connects to their malicious Python CS:GO server. This post details their journey through the CS:GO binary and conducts a technical deep dive into various identified bugs. They conclude by presenting a proof of concept (POC) exploit that leverages four different logic bugs into remote code execution in the game’s client, triggered when a client connects to the server.