MGASA-2026-0573: Updated minetest package fixes security vulnerabilities
The client mesh loaders suffer from memory safety issues including unbounded out-of-bounds heap writes and use-after-free, which might be used to obtain arbitrary code execution on the client. (High) Installing content from an untrusted ContentDB instance can result in remote code execution. (Moderate) Singleplayer: Lua sandbox escape from mod (Critical)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
mageia/minetestto a version that resolves this vulnerability.Fixed in 5.18.0-1.1.mga10
Event History
Frequently Asked Questions
Who is most at risk from this issue?
Clients that load attacker-controlled mesh content are exposed to memory-safety flaws that may allow arbitrary code execution. Users who install content from an untrusted ContentDB instance or use untrusted mods in singleplayer are also at risk.
What does an attacker need to exploit it?
The attacker needs a way to get a victim to load malicious mesh content, install content from an untrusted ContentDB instance, or run a malicious mod in singleplayer. The advisory indicates these paths can lead to code execution or a Lua sandbox escape.
What can be done before an update is available?
Do not install content from untrusted ContentDB instances, and avoid running untrusted mods in singleplayer. Treat mesh content from untrusted sources as potentially malicious.