This vulnerability (CVE-2025-34124) involves a stack-based buffer overflow triggered by specially crafted object sprite names within .h3m map files in Heroes of Might and Magic III (Complete 4.0.0.0, HD Mod 3.808 build 9, Demo 1.0.0.0). When the game loads these malicious map files, the overflow can corrupt memory and potentially allow execution of arbitrary code. The attack vector requires user interaction to open the malicious map file. The CVSS 4.0 base score is 8.4, indicating high severity, with local attack vector, low attack complexity, no privileges required, but user interaction needed. The vulnerability affects confidentiality, integrity, and availability with high impact. No patches or vendor advisories are currently available.

Successful exploitation can result in arbitrary code execution on the victim's system, compromising confidentiality, integrity, and availability of the affected machine. The attack requires local user interaction to open a malicious map file, limiting remote exploitation. There are no known active exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid opening untrusted or suspicious .h3m map files in affected versions of Heroes of Might and Magic III. Monitor official channels for updates or patches from The 3DO Company.