CVE-2026-116099

Fusion Creators Studio SCP Containment Breach Multiplayer Skynet++ Virtual Machine BlitzBanks out-of-bounds write

State: Published
Severity: 5.3 Medium
Published: Oct 25, 2026
Updated: Oct 26, 2026
Reserved: Oct 25, 2026

Description

A flaw has been found in Fusion Creators Studio SCP Containment Breach Multiplayer up to 1.295. This issue affects the function BlitzBanks of the component Skynet++ Virtual Machine. Executing a manipulation can lead to out-of-bounds write. The attack can be executed remotely. The exploit has been published and may be used. Upgrading to version 1.3R is capable of addressing this issue. It is recommended to upgrade the affected component.

Scores

CVSS	Score	Vector	Source
4.0	5.3 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P	VulDB
3.1	6.3 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C	VulDB
3.0	6.3 Medium	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C	VulDB
2.0	7.5 High	AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:OF/RC:C	VulDB

Weaknesses

CWE-787 Out-of-bounds Write
CWE-119 Memory Corruption

Affected Products

Product	Versions
SCP Containment Breach MultiplayerFusion Creators Studio	1.295Affected 1.3RNot affected

References

VDB-426167 | Fusion Creators Studio SCP Containment Breach Multiplayer Skynet++ Virtual Machine BlitzBanks out-of-bounds writevdb-entrytechnical-description
VDB-426167 | CTI Indicators (IOB, IOC, IOA)signaturepermissions-required
CVE-2026-116099 | CVE Analysis and Reportthird-party-advisory
Submit #1001276 | Fusion Creators Studio SCP: Containment Breach Multiplayer 24934269 Out-of-bounds Writethird-party-advisory
https://drbloop.dev/blog/one-click-remote-code-execution-in-scp-containment-breach-mutiplayerrelated
https://store.steampowered.com/news/app/1782380/view/670629296167978253related
https://github.com/drbloop2000/SCP-CBM-RCE/tree/mainexploit
https://steamdb.info/patchnotes/25701366/broken-linkpatch

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.