Moments ago CD Projekt Red released a hotfix for Cyberpunk 2077. The Patch is labeled 1.12 and is currently only available for PC. This hotfix corrects an issue discovered not long ago and it brought up a riot among the modders community because they felt they were blamed for it. Let’s check out the details and what happened!
Cyberpunk 2077 Hotfix 1.12 was released today, on Friday February 5th, 2021. It is currently only available for PC players and contains the following fixes:
“This update addresses the vulnerability that could be used as part of remote code execution (including save files)” – the first sentence of the patch notes tells us.
- Fixed a buffer overrun issue.
- Removed/replaced non-ASLR DLLs.
Three days ago, on Tuesday, CD Projekt Red posted a warning message on their official forums:
“If you plan to use Cyberpunk mods/custom saves on PC, use caution. We’ve been made aware of a vulnerability in external DLL files the game uses which can be used to execute code on PCs. Issue will be fixed ASAP. For now, please refrain from using files from unknown sources.”
Not long after that the modding community (people, who create and develop mods for Cyberpunk 2077) returned with a number of statements and accusations.
What is modding and what are modders? Quick overview for those of you who might not know this. Modders are people, usually fans of the game or games, that provide thirt-party modifications to the games. They often alter a gameplay or visual and esthetics of the game. Mods are additional software (files you copy or install to your machine) that may change little things like the zoom of the minimal in Cyberpunk 2077 or alter things on a larger scope like allowing you to change your characters’ appearance after you have gone through the character creation or even change the driving experience in the game.
Modder and forum user yamasushi commented under CD Projekt Red’s warning message asking them to admit to poor wording on their part that made it look as if the modders were the reason this possible exploit became reality.
“What CDPR posted above is WRONG, it isn’t caused by an external DLL, the vulnerability is caused by a buffer overflow in a function they use to load strings, this function is used more than 100 times in the game, it is used to load the save games, the archive assets and other parts that we haven’t investigated. This is 100% CDPR’s fault, it isn’t anybody else’s fault. This is caused by a lack of proper unit testing.”
Further in his post yamasushi confronts the developers of the game with a statement that this issue is not just on the PC platform, but on all of them:
“Just so you know everyone this isn’t just a PC issue, every platform is affected.”
Reading further on the topic of today’s patch and the controversial story of who is responsible and for what, I think I would leave it to you to make up your own minds as I really don’t know enough about coding to have an opinion.
Today’s Hotfix 1.12 is extremely small in size and on GOG I downloaded only 14 MB, it was done in seconds.
If you plan on running mods, you should always download third party content from trusted sources. Regardless of the fact that this particular issue has been fixed on PC, you take responsibility for your own actions if you download third party content for the game, especially if it’s from an unknown source.
CD Projekt Red is currently working on a much larger Patch that they plan to release in February, according to the Cyberpunk 2077 Roadmap for 2021.
The company has a habbit of calling the small and urgent updates “hotfixes”, like the one this news article is about. The larger updates that bring more than just quick fixes are “patches”.
The February one is of the later kind and the polish studio told us it would be bigger than the 1.10 patch they released in January.
