Critical: Exploitable Network Functions Allow Host Crashes and Potential Heap Corruption

Status:	Pending Moderation
Priority:	Critical
Added by:	math.h on September 5, '26
Assigned to:	Unassigned
Due date:
Reported for:	S06.04

Steps to Reproduce

1. Make a mod
2. Go on a rampage crashing every host you want.

Explanation

Exposed network function allow any client to crash host directly or corrupt heap

Following functions are exposed, and can be called through blueprint mods to crash host
APlayerCharacter::Server_TeleportToPlayer -> pass object param as null
APlayerCharacter::Server_TeleportPlayerTo -> pass object param as null
APlayerCharacter::Server_SpawnCritters -> pass object param as null
APlayerCharacter::Server_SpawnEnemies -> pass object param as null
APlayerCharacter::Server_AddToTraceQueue -> pass object param as null. / Possible heap corruption with malformed struct
APlayerCharacter::Server_InstantRevive -> pass object param as null
APlayerCharacter::Server_CheatSpawnDropPodOnSelf -> spacerig only/can lag the f*** out of host, if spam called in mission, including completely stalling terrain calculation thread

Watchers

Watch