Update: CD Projekt says the security flaw should now be fixed, thanks to the new 1.12 hotfix.
Hotfix 1.12 is now available on PC!This update addresses the vulnerability that could be used as part of remote code execution (including save files):- Fixed a buffer overrun issue.- Removed/replaced non-ASLR DLLs. pic.twitter.com/LAkBfVpnXfFebruary 5, 2021
CD Projekt Red is warning Cyberpunk 2077 players to be cautious when using mods, as a recently discovered vulnerability in a DLL file could be used to execute code on PCs and PlayStation 4 consoles running the game.
The issue came to light over the weekend thanks to Red Tools mod team member PixelRickyRick and redditor Romulus_Is_Here, who explained that "through the use of a mod or a crafted save game, malicious codes can be executed to take control of the PC by the creator of the save game/mod." The exploit was initially thought to be limited to the PC version of the game, but PixelRickyRick later confirmed that the PS4 version is vulnerable as well.
CD Projekt was made aware of the vulnerability a week ago, according to the post, but only acknowledged it today.
If you plan to use @CyberpunkGame mods/custom saves on PC, use caution. We've been made aware of a vulnerability in external DLL files the game uses which can be used to execute code on PCs. Issue will be fixed ASAP. For now, please refrain from using files from unknown sources.February 2, 2021
"A group of community members reached out to us to bring up an issue with the external DLL files the game uses," the studio said in a statement sent to Eurogamer. "This issue can be potentially used as part of a remote code execution on PCs. We appreciate their input and are working on fixing this as soon as possible. In the meantime, we advise everyone to refrain from using files obtained from unknown sources. Anyone who plans to use mods or custom saves for Cyberpunk 2077 should use caution until we release the aforementioned fix."
If you don't want to wait for that, the latest update to the Cyber Engine Tweaks mod, which includes "performance fixes, bug fixes, and fun hacks to play with," also addresses the vulnerability. I've reached out to CD Projekt to ask if there's a time frame for the official fix, and will update if I receive a reply.
