“Combining the bugs leads to the proof of concept that exploits a CS:GO client by only connecting to a malicous, attacker controlled server.”
Neodyme chained four logic bugs into remote code execution on any CS:GO client that joins their server. The game has 21 million players a month and runs on the Source engine from 2004, which inherits code from GoldSrc and Quake. Every texture, model and map file from a community server goes through parsers fed attacker data. Valve fixed it in April 2021 and the post waited two years.