CVE-2007-4370: Racer client and server UDP buffer overflow allows remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityThe vulnerability is remotely exploitable without authentication and has a public exploit plus very high EPSS, though it affects an old, likely uncommon game and is not in KEV.

What it is

Racer 0.5.3 beta 5 contains multiple buffer overflows in both its client and server components. A long string sent to UDP port 26000 can overflow a buffer and allow remote code execution. The flaw is remotely reachable without authentication, making any exposed instance a direct target.

Impact

An attacker can execute arbitrary code with the privileges of the Racer client or server process. Because both components are affected, a single crafted UDP packet can compromise either a listening server or a connected client.

Attack surface

The flaw is reached over the network via UDP port 26000, as reflected in the AV:N/AC:L/Au:N vector. No authentication or user interaction is required; the attacker only needs network reachability to the port.

Exploitation

CVE-2007-4370 is not listed in CISA KEV, but a public Exploit-DB entry (4283) exists and EPSS reports a 30-day probability of roughly 0.59 (99th percentile), indicating high likelihood of attempted exploitation.

What to do

• Upgrade Racer to a version later than 0.5.3 beta 5, or remove the software if no fixed release exists.
• Block or restrict inbound UDP port 26000 at the perimeter and on host firewalls.
• Isolate Racer installations on segmented networks so they are not reachable from untrusted hosts.
• Monitor vendor and OSVDB/SecurityFocus advisories for a patched build and apply it as soon as available.

Detection

• Alert on inbound UDP traffic to port 26000 from external or unexpected sources.
• Inspect UDP payloads to port 26000 for oversized strings or shellcode-like patterns.
• Monitor Racer processes for crashes or unexpected child processes that could indicate exploitation.
• Correlate IDS/IPS signatures for Racer buffer overflow attempts with host process telemetry.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.