# Malformed map detailed texture files in GoldSrc games lead to Remote Code Execution

Malformed maps/<map>_detail.txt overflows a stack buffer in hw.dll when r_detailtextures is enabled, letting a malicious server crash or RCE clients.

- Payout: $350
- Severity: medium
- Program: Valve
- Credited: nyancat0131
- Disclosed: 2019-09-17
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/505173
- Library page: https://bugbountylibrary.com/r/h1%3A505173
- Tags: domain:desktop impact:dos impact:rce kind:bounty platform:hackerone sev:medium tech:windows technique:chained vuln:memory-corruption vuln:rce

**Target:** GoldSrc engine hw.dll detail texture parser (maps/<map_name>_detail.txt)
**Root cause:** Unbounded copy of detail texture file contents into a fixed stack buffer in hw.dll when parsing maps/<map_name>_detail.txt.
**Steps:**
1. Place crafted `cs_assault_detail.txt` in `cstrike/maps`
2. Start game, console: `r_detailtextures 1`
3. Host new game on `cs_assault`
4. Game crashes loading detail textures
5. Dedicated server variant: AMXX plugin uses `precache_generic` on `maps/cs_assault_detail.txt` and `client_cmd` to force `r_detailtextures 1`
6. Client connects and crashes on load
**Exploitation:** Server precaches the malicious detail file via precache_generic and forces clients to enable r_detailtextures via client_cmd (slowhack), so any connecting client parses the file and overflows the stack, enabling RCE on the victim.
**Escalation:** Server-side slowhack (client_cmd) turns a local file-parse bug into remote client compromise for all connecting players.
**Insight:** Client-side parsers of server-supplied asset files (detail textures, precached generics) are attacker-controlled input; combined with engine slowhack primitives like client_cmd, a local stack overflow becomes remote RCE against every connecting client.