Vulnerability in The Ultimate Doom allows Snake to play in-game

A bug in the save system of computer game The Ultimate Doom version 1.9 makes it possible to execute arbitrary code within the game. The developer who discovered this had the game running Snake and pointed to future mods that could exploit this vulnerability.

Thanks to a bug in The Ultimate Doom’s save system, developer Anatoly Shashkin managed to perform arbitrary code execution in this 1995 game. on his Twitter account. He did this by writing an exploit where he runs a savegame as a PSPR action code pointer. The entire process of how he exploits the vulnerability in The Ultimate Doom can be read on github, as well as two other vulnerabilities that can be used to modify the game.

According to the developer, this vulnerability makes it possible to enable far-reaching Doom mods in the future. According to Shashkin, the arbitrary code execution only works in Ultimate Doom version 1.9 and not in Doom 2 or the more recent Doom games.