CDPR Warns Cyberpunk 2077 Gamers To Avoid Mods Due To Serious Security Exploit

CD Projekt Red’s tweet explained the issue occurs when malicious mods are downloaded and modify things that they should not change. The tweet then explains that this vulnerability will be fixed “ASAP,” but it is quite dangerous to players who have already ventured out to install mods.
For a deeper explanation of the issue, the tweet further states that Cyberpunk 2077 would use external dynamic linked library (DLL) files when running the game. Andrew Kramer, a Dakota State University professor of computer science, speculates that this is case of DLL hijacking whereby a mod could include a malicious DLL that could be executed by Cyberpunk 2077. Ultimately, this issue likely falls under the purview of common weakness enumeration (CWE) 427, which explains that “The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.”

No matter the specifics, this issue poses an undue security risk to Cyberpunk 2077 players who want to mod their game. For the time being, it is best to avoid mods from Cyberpunk 2077 altogether until CD Projekt Red and independent researchers can verify that all the kinks are worked out. Hopefully, no more issues will crop up, though, but keep an eye on HotHardware for updates if they do.