Aggregates CVE and security vulnerability intelligence across all openttd-related products, including CVSS, EPSS, publication dates, and vulnerability intelligence data.
Common weakness patterns include vendor risk buffer overflow, vendor risk memory corruption, and vendor risk input validation, with potential vendor impact application crash across vendor surface production workloads use cases.
| CVE | Summary | Source | Max CVSS | EPSS % | Published | Updated |
|---|---|---|---|---|---|---|
| CVE-2012-0049 | OpenTTD before 1.1.5 contains a Denial of Service (slow read attack) that prevents users from joining the server. | [email protected] | 4.3 | 1.34% | 2019-11-07 | 2026-06-16 |
| CVE-2013-6411 | The HandleCrashedAircraft function in aircraft_cmd.cpp in OpenTTD 0.3.6 through 1.3.2 allows remote attackers to cause a denial of service (out-of-bounds read and crash) by crashing an aircraft outside of the map. | [email protected] | 5.0 | 3.31% | 2013-12-14 | 2026-06-16 |
| CVE-2012-3436 | OpenTTD 0.6.0 through 1.2.1 does not properly validate requests to clear a water tile, which allows remote attackers to cause a denial of service (NULL pointer dereference and server crash) via a certain sequence of steps related to "the water/coast aspect of tiles which also have railtracks on one half." | [email protected] | 5.0 | 3.38% | 2012-10-09 | 2026-06-16 |
| CVE-2012-0048 | OpenTTD 0.3.5 through 1.1.4 allows remote attackers to cause a denial of service (game pause) by connecting to the server and not finishing the (1) authorization phase or (2) map download, aka a "slow read" attack. | [email protected] | 4.3 | 2.53% | 2012-08-25 | 2026-06-16 |
| CVE-2011-3343 | Multiple buffer overflows in OpenTTD before 1.1.3 allow local users to cause a denial of service (daemon crash) or possibly gain privileges via (1) a crafted BMP file with RLE compression or (2) crafted dimensions in a BMP file. | [email protected] | 4.6 | 0.38% | 2011-09-08 | 2026-06-16 |
| CVE-2011-3342 | Multiple buffer overflows in OpenTTD before 1.1.3 allow remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via vectors related to (1) NAME, (2) PLYR, (3) CHTS, or (4) AIPL (aka AI config) chunk loading from a savegame. | [email protected] | 7.5 | 5.01% | 2011-09-08 | 2026-06-16 |
| CVE-2011-3341 | Multiple off-by-one errors in order_cmd.cpp in OpenTTD before 1.1.3 allow remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via a crafted CMD_INSERT_ORDER command. | [email protected] | 7.5 | 3.83% | 2011-09-08 | 2026-06-16 |
| CVE-2010-4168 | Multiple use-after-free vulnerabilities in OpenTTD 1.0.x before 1.0.5 allow (1) remote attackers to cause a denial of service (invalid write and daemon crash) by abruptly disconnecting during transmission of the map from the server, related to network/network_server.cpp; (2) remote attackers to cause a denial of service (invalid read and daemon crash) by abruptly disconnecting, related to network/network_server.cpp; and (3) remote servers to cause a denial of service (invalid read and applicatio | [email protected] | 7.5 | 3.67% | 2010-11-17 | 2026-06-16 |
| CVE-2010-2534 | The NetworkSyncCommandQueue function in network/network_command.cpp in OpenTTD before 1.0.3 does not properly clear a pointer in a linked list, which allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted request, related to the client command queue. | [email protected] | 5.0 | 3.35% | 2010-07-28 | 2026-06-16 |
| CVE-2010-0406 | OpenTTD before 1.0.1 allows remote attackers to cause a denial of service (file-descriptor exhaustion and daemon crash) by performing incomplete downloads of the map. | [email protected] | 4.0 | 1.76% | 2010-05-05 | 2026-06-16 |
| CVE-2010-0402 | OpenTTD before 1.0.1 does not properly validate index values of certain items, which allows remote authenticated users to cause a denial of service (daemon crash) or possibly execute arbitrary code via a crafted in-game command. | [email protected] | 6.5 | 2.22% | 2010-05-05 | 2026-06-16 |
| CVE-2010-0401 | OpenTTD before 1.0.1 accepts a company password for authentication in response to a request for the server password, which allows remote authenticated users to bypass intended access restrictions or cause a denial of service (daemon crash) by sending a company password packet. | [email protected] | 6.5 | 1.20% | 2010-05-05 | 2026-06-16 |
| CVE-2009-4007 | Unspecified vulnerability in the NormaliseTrainConsist function in src/train_cmd.cpp in OpenTTD before 0.7.5-RC1 allows remote attackers to cause a denial of service (daemon crash) via certain game actions involving a wagon and a dual-headed engine. | [email protected] | 5.0 | 2.12% | 2009-12-28 | 2026-06-16 |
| CVE-2008-3547 | Buffer overflow in the server in OpenTTD 0.6.1 and earlier allows remote authenticated users to cause a denial of service (persistent game disruption) or possibly execute arbitrary code via vectors involving many long names for "companies and clients." | [email protected] | 9.0 | 4.73% | 2009-03-10 | 2026-06-16 |
| CVE-2008-3577 | Buffer overflow in src/openttd.cpp in OpenTTD before 0.6.2 allows local users to execute arbitrary code via a large filename supplied to the "-g" parameter in the ttd_main function. NOTE: it is unlikely that this issue would cross privilege boundaries in typical environments. | [email protected] | 4.6 | 0.45% | 2008-08-10 | 2026-06-16 |
| CVE-2008-3576 | Buffer overflow in the TruncateString function in src/gfx.cpp in OpenTTD before 0.6.2 allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via a crafted string. NOTE: some of these details are obtained from third party information. | [email protected] | 10.0 | 6.27% | 2008-08-10 | 2026-06-16 |
| CVE-2006-1999 | The multiplayer menu in OpenTTD 0.4.7 allows remote attackers to cause a denial of service via a UDP packet with an incorrect size, which causes the client to return to the main menu. | [email protected] | 5.0 | 9.15% | 2006-04-25 | 2026-06-16 |
| CVE-2006-1998 | OpenTTD 0.4.7 and earlier allows local users to cause a denial of service (application exit) via a large invalid error number, which triggers an error. | [email protected] | 2.1 | 0.90% | 2006-04-25 | 2026-06-16 |
| CVE-2005-2764 | Multiple buffer overflows in OpenTTD before 0.4.0.1 allow attackers to cause a denial of service (crash) and possibly execute arbitrary code via unspecified vectors. | [email protected] | 7.5 | 2.92% | 2005-09-21 | 2026-06-16 |
| CVE-2005-2763 | Multiple format string vulnerabilities in OpenTTD before 0.4.0.1 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unspecified vectors. | [email protected] | 7.5 | 2.73% | 2005-09-06 | 2026-06-16 |