The Operative: No One Lives Forever

Cyberpunk Vulnerability and a Temporary Ban on Save Games

  • Comment
Update: CDPR have since released Hotfix 1.12 which addresses the exploit described in this news post meaning our temporary ban on save games is lifted again.

TL;DR

Very recently, news broke that the community discovered a vulnerability with Cyberpunk 2077 that would allow for arbitrary (potentially malicious) code to be executed when a save game is loaded. This means that there is potential for someone to hide malicious code in a save game and have an unsuspecting user load it, thus executing said code.

CDPR have since been made aware of this vulnerability in their game, but until they have fixed it, we’re forced to impose a temporary ban on new save game uploads effective from now. 

It is strongly recommended to install Cyber Engine Tweaks by yamashi, which patches this vulnerability.


The exploit

In essence, the exploit allows a nefarious user to manipulate a save game file in such a way that it appears to load normally (so the unsuspecting user does not notice anything wrong), when in reality it will redirect to an external dll used by the game. This can then be used to execute malicious code on the victim’s PC. 

We’d like to express our gratitude to the Cyberpunk modding community and PixelRickyRick in particular for finding and reporting this serious exploit to CDPR.

(You can find a more technical and detailed explanation of how exactly the exploit works in this PSA on the Cyberpunk subreddit u/Romulus_Is has thankfully written up.)

At this moment, the exploit/vulnerability is confirmed and CDPR have acknowledged it and pledged to fix the issue as a matter of urgency.


What you can do to be safe

We strongly recommend using Cyber Engine Tweaks by yamashi, who has provided a patch fixing the vulnerability and preventing the exploit from working. A huge thank you goes out to yamashi for moving so quickly.

If you are not using Cyber Engine Tweaks yet, we advise you to install it especially if you’re using mods and/or save games from other sources. Cyber Engine Tweaks installs seamlessly with our mod manager Vortex.

Apart from that, please be cautious and only download/install save games and 3rd party tools (generally speaking, tools that contain exe and/or dll files) from trusted sources until CDPR have addressed this issue. 


Temporary ban on save games

It is unfortunate that the game shipped with this vulnerability, but CDPR have since promised to address the issue as soon as possible. Until we can confirm the exploit has been fixed, we are forced to impose a temporary ban on save games effective from now. Any save game uploaded to the site after this announcement will be removed. 

We will be updating this post when CDPR have fixed the exploit at which point we should be able to lift the temporary ban on save games.

We apologise for the inconvenience and thank you for your understanding.

59 comments

Comments locked

A moderator has closed this comment topic for the time being
  1. BigBizkit
    BigBizkit
    • Designer
    • 386 kudos
    Locked
    Sticky
    CDPR have released Hotfix 1.12 that fixes the exploit, meaning we're lifting the ban on save games.

    More info: https://forums.cdprojektred.com/index.php?threads/hotfix-1-12.11079314/
  2. SteveB88
    SteveB88
    • member
    • 9 kudos
    I'm extremely disappointed in CDRP. They kept going on and on about how they will release it when it is ready. Clearly, it's nowhere ready for release but they went ahead and released it anyway. I really hoped that they were better than the other developers when it came to rushing a release

    I'm not going to be buying Cyberpunk again, at least until they make it playable. What did they expect? That they could release a broken game and no-one would notice?
    1. VarisXL
      VarisXL
      • member
      • 1 kudos
      The reason they released it so early is because people nagged them, sadly. The problem is the crunch they had, not that it was too early to release. A lot of content got cut out/rushed and I think if they never had the crunch then cyberpunk would've released in late december - mid january. It's a real shame, but the Witcher 3 was the exact same problem. People even dubbed it the Glitcher 3 if I remember correctly. Witcher 3 is now very highly regarded of course, so I think with enough time it'll become much much better.
    2. driftscape
      driftscape
      • member
      • 1 kudos
      Right...
    3. Supadrumma4411
      Supadrumma4411
      • member
      • 1 kudos
      Rubbish. The CEO was like "GIMME MONEY RELEASE NOW" cause they saw an opportunity to make a quick buck during the holiday period plus the fact that extra people would be home due to Covid. It had NOTHING to do with the community nagging the devs, and had EVERYTHING to do with Corporate greed nothing more. 
    4. xybolt
      xybolt
      • premium
      • 5 kudos
      It's a real shame, but the Witcher 3 was the exact same problem. People even dubbed it the Glitcher 3 if I remember correctly. Witcher 3 is now very highly regarded of course, so I think with enough time it'll become much much better
      Hence I do not understand the reactions. I am a software engineer myself and what the company tried with this game is not easy, there are a lot interconnected complex scripting systems going on. I have pre-ordered the game and I did not have played it because I knew this would happen. I have installed the game to check its binaries, giving me an insight of what for challenges they (the developers) have to tackle down. Because of our high expectations, the developers have to program complex pieces of code that are all connected with each other into a single application. Having bugs in new complex AAA games is inevitable nowadays.

      Even RDR2, a game that is well-owned and even won two steam awards for 2020 had launch issues when it was available for PC (I got it on Rockstar Launcher) and it took Rockstar months to iron out the majority of the problems. Those that owns the game on Steam have already a RDR2 game with two or three huge patches ready for them on the day of the release (the launch was a month after that one on Rockstar launcher).

      Therefore I do not agree with the majority of the complaints here. Yes I understand that there are problems that should not be a part of the delivered product but it is not fair to complain or criticize for that. Give the company some credit (because of their earlier products and current service) and see if they are able to iron it out the months after. This is not the first game that is unfinished at launch. Hell, even Batman: Arkham Knight got two delays and had a lot negative reviews on the day of launch. That game is now having a good rating because of the numerous patches the months after.
    5. KYLE215PS3
      KYLE215PS3
      • premium
      • 21 kudos
      You can thank the people who sent death threats to CDPR for the delay...along with media pressure to release it.
    6. KYLE215PS3
      KYLE215PS3
      • premium
      • 21 kudos
      wow thats a really good point! thank you for this
    7. DexLuther3
      DexLuther3
      • supporter
      • 0 kudos
      ?The reason they released it so early is because people nagged them, sadly. The problem is the crunch they had, not that it was too early to release. A lot of content got cut out/rushed and I think if they never had the crunch then cyberpunk would've released in late december - mid january. It's a real shame, but the Witcher 3 was the exact same problem. People even dubbed it the Glitcher 3 if I remember correctly. Witcher 3 is now very highly regarded of course, so I think with enough time it'll become much much better.
      I'm a game tester. We generally start crunch months before devs do. Basically whenever there's a milestone, testers are crunching to get ready for it, crunching to get through it and crunching to finish it while devs get to enjoy their weekends. When they do have to do overtime, I've seen them get lunch (and/or dinner) paid for them. Hell on one project the devs had dinner catered. They locked down the cafeteria and had actual catering come in. It was paid for by the company. Devs whining about crunch is just that. Whining. They are paid more, know to expect it (it's not a secret and hasn't been so for ages), and most of the time the crunch in their own fault.

      Crunch wouldn't happen if they spread the work out over a longer period of time and managed their time better. A lot of game development is smooth sailing for a while, then cram for a deadline. Panic when things go wrong. Cram some more and then go back to smooth lazy sailing once the deadline has passed.

      This isn't only a case of the public nagging them. Sure it didn't help, but there isn't 8 years of development worth of content in the game. Not to mention how the CEO was talking about about the many features we never got just last year. Just a couple months before release he even stated "The game runs surprisingly well" on the older consoles, which was a blatant lie. Why all the hoopla about putting a penis on a girl character when it changes absolutely nothing in the game (You can't even see it anywhere in the game except the menu)?

      What actually happened in the CEO made a ton of promises and got a fat head from an inflated ego. Developed a game for 6-7 years, then somehow got Keanu Reeves involved, and at the same time also announced a release date. Wanting to brown nose to Keanu, they tried to change everything they had developed for 6-7 years to revolve around him. In about a year they had to rebuild everything they had instead of finishing content that needed to be finished, which is probably why so many of the features that were talked about were cut or are barely in the game.

      They had to build a game in the time that's usually used for polish. All because of the ego and hubris of the CEO. 
  3. Jena84Plissken
    Jena84Plissken
    • member
    • 43 kudos
    Always the same story! just the money!
    Why not complete a product and test it properly?
    Because something "unplayable" is sold, regardless of the exploit it is full of bugs / crashes on everything.
    Is it possible that they do not notice a thousand defects?
    No ! verdict an anime 1!
    Now they do not care and all!
    Words words words...
  4. Wuji
    Wuji
    • member
    • 0 kudos
    CDPR made aware. Don't bother to post this info on their official forums, instead opt to post it on Twitter. 
    I don't use Twitter and wouldn't of been aware of this if not for youtube reports and the Nexus Forums.
    CDPR have become a joke.
    1. deleted82995898
      deleted82995898
      • account closed
      • 0 kudos
      Always has been.
    2. larrackell
      larrackell
      • member
      • 1 kudos
      They did post it on their forums. 
  5. AssimilatorX
    AssimilatorX
    • member
    • 0 kudos
    This game will never be finished or fixed. Patch (a) broke (z), patch (z) broke c, and d) patch (c,and d) broke (a) again. Just put a damn sticker on (Early Access) Not even mass effect andromeda was this bad at launch day. CDPR should have done the right thing and not to release this garbage code collection called game. At least if they must hit the market they should put a sticker on it a "Early Access Pre-Alpha" so we should know what to expect. I purchased updates for my Alienware 17 R4 laptop in a form of an Alienware Graphics Amp with RTX 2080 OC. Regardless CDPR say this "game" runs nice on 1660. I don't really experience the nicely run part on my RTX 2080 4k with only 6GB vram used out of 8GB, only bugs. Even with patch 1.12 i still falling through the map, i tried turning resolution down, and its just getting worst in performance. I give up on this game and better not to bother any more. Deeply regret buying it for £59 on launch. My female character regularly have a penis clipping through her pants. REALLY????
  6. MrDave
    MrDave
    • premium
    • 509 kudos
    Interesting. I had such regrets at buying the BG3 early access release that I didn't even bother buying this game. One 70 dollar disappointment is enough for one year.
    1. NotWord2
      NotWord2
      • premium
      • 794 kudos
      Unlike Cyberpunk 2077 that was shipped on a disc and advertised as a finished product, Baldur's Gate 3 is still in Early Access phase. Devs themselves stated that the high price is dedicated for the hardcore fanbase that is willing to embrace the game for what it is.
    2. IServeTheMoon
      IServeTheMoon
      • member
      • 2 kudos
      That's a bullshit corpo talk for "we want to exploit the most loyal fans of this franchise by asking them to pay full price for a product that is nowhere near shipping ready" but hey, it's not my money.
    3. wolfgrimdark
      wolfgrimdark
      • premium
      • 876 kudos
      Big difference though between buying an early access game like BG3 and a game advertised as full released like Cyberpunk. I like both games but BG3 was way more polished and bug-free in early access then Cyberpunk was on full release.

      I have 167 hours played in early access BG3 and its an amazing game - great looking graphics, tons of hidden things to discover when exploring, many subtle layers to dialogue, lots of character variety, and overall looking to be one of the best games of 2021 if it gets released this year.

      People don't have to buy early access either - there choice and there is no gun pointing to one's head. There is full disclosure on buying an EA game for the buyer to beware. Since it is early access they also want people to help test and provide feedback which means those serious about interest, not those looking to pick up  game for cheap and then sit on it till full release.

      Either way there is no real comparison between BG3 EA and a fully released Cyberpunk with misleading advertising and broken promises.

      Still Cyberpunk is still an amazing game and I got two play throughs before I set it aside to wait for official patches and updates.
    4. madpaddy
      madpaddy
      • premium
      • 94 kudos
      THIS ^
    5. millyrainbow
      millyrainbow
      • member
      • 1 kudos
      @IServeTheMoon
      Not really? I mean in some cases yes, but in this very particular case, its a common tactic done to get early beta testing without just giving the game away. Theyre very up front and very open about the state of the game, and if you bought it expecting anything else, its totally on you. If you wanted a finished product, you should wait.
      This mentality right here is why early access is such a terrible idea to begin with. People look at it and are like 'oh i can play the game EARLY' when all early access is, is just a glorified beta test or in many cases not even out of alpha test.
    6. Revan7even
      Revan7even
      • premium
      • 13 kudos
      At least you know it will be finished in a year or two... *coughs in Star Citizen*
    7. DexLuther3
      DexLuther3
      • supporter
      • 0 kudos
      ?Unlike Cyberpunk 2077 that was shipped on a disc and advertised as a finished product, Baldur's Gate 3 is still in Early Access phase. Devs themselves stated that the high price is dedicated for the hardcore fanbase that is willing to embrace the game for what it is.
      Early Access is basically pay to be a game tester (instead of being paid like I do) and get the game for "free" (because you already paid for it) when/if the game eventually comes out.

      The problem is people are dumb and equate early access/beta/alpha to being a demo/preview. You see it all the time. Company puts out an Alpha/beta or enters early access people get access and immediately the forums and anywhere talking about it is full of people complaining about all the bugs and how the game is unfinished, and in cases where they paid demanding a refund. 
  7. ACel13
    ACel13
    • member
    • 0 kudos
    Locked
    Are there seriously people so lame they will download and load someone else's save file rather than play the game themselves?
    Pathetic.
    1. BinaryOmlet
      BinaryOmlet
      • member
      • 3 kudos
      It's not that; there's a method to swap your V with one in another save file. That's what a majority of people use other saves for.
    2. ACel13
      ACel13
      • member
      • 0 kudos
      That both explains nothing and is still equally stupid. Why are people downloading and loading other people's saved games when they can just play the game for themselves? If someone did something you find interesting, then just repeat what they did. It's not hard.
    3. davyjonesttv
      davyjonesttv
      • premium
      • 0 kudos
      I don't think you understood.
      It has nothing to do with not playing the game for yourself; but it's about customizing your character.
      Some people don't want to spend hours and hours customizing their character and some people ARE doing that and uploading those 'saves' which is only for the cosmetic character preset.

      TL:DR People use game saves to 'save' time in character customization.
    4. ACel13
      ACel13
      • member
      • 0 kudos
      That's just as equally lame and a really petty excuse for laziness and stupidity.
      Making a custom V takes hardly any time.
    5. Supadrumma4411
      Supadrumma4411
      • member
      • 1 kudos
      Imagine being so pathetic you judge how other people experience games OF THEIR OWN FREE WILL. How is it in any way your business how they spend their own free time? I don't get people like you at all, WHY DO YOU GIVE A s#*!? 
    6. 42marvin42
      42marvin42
      • member
      • 14 kudos
      @ACel13
      i fully agree.

      imagine, they are also people out there who are too  lazy and stupid to edit a simple ini file, instead they using mods.
      editing the control scheme takes hardly any time.

      /irony off

      yeah i know, dont feed the troll. 
    7. ACel13
      ACel13
      • member
      • 0 kudos
      Supadrumma
      Look at you and your white knight s*** getting all offended on behalf of people you don't even know. Why do you give a s*** about them or what I do with my time? You're obviously judging me for calling out other people on being lame. I don't give a s*** about them. I'm just surprised these people can't be bothered to use the stock V or take 10 seconds swap a nose, hair color, or skin shade. They're trying to save time? They probably spent more time browsing, downloading, unpacking, and moving the save file than it would have to just make their own V.

      52marvin
      save game file =/= mod
      I edited the .ini myself for the dodge/crouch swap mod. Took all 60 seconds to do it. I put my money where my mouth is.
    8. 42marvin42
      42marvin42
      • member
      • 14 kudos
      @ACel13
      That's just as equally lame and a really petty excuse. you are just too lazy for browsing, downloading, unpacking, and moving the ini file.
      Pathetic.
    9. Pickysaurus
      Pickysaurus
      • Community Manager
      • 649 kudos
      I think that's enough, you guys can just agree to disagree on this one. 
  8. HannaVictoria
    HannaVictoria
    • supporter
    • 15 kudos
    Well, the good and bad news, is when the Gaming Industry collapses it will probably follow the path of the implosion of the Comics industry back in the 90s. Meaning that eventually it will turn back into an industry that exists primarily to make the thing it makes for the people who like the thing. By people who also like that thing, not people who got into the industry to make big money, quick without much care to what kind of quality their actually putting out.

    Well... that and license things out. Which considering how long it took to make good comic book movies? There is still hope for gaming movies to become associated with quality one day. (though by then the movie industry will likely be radically different in one fashion or other)
    1. iXenite
      iXenite
      • premium
      • 18 kudos
      The gaming industry has already collapsed once before.
    2. driftscape
      driftscape
      • member
      • 1 kudos
      It's not going to collapse. Too much money is involved and more dumb people continue to defend and buy bad products. Guarantee you TES6 will be a massive success in sales. PC gaming isn't niche anymore. Neither is modding.
    3. LoganPP
      LoganPP
      • member
      • 40 kudos
      Yeah, the comics industries is doing produts for the consumers... yeah... Thats must be way the biggest comics industries only make comics with social justice making their sells fall everyday. If the games follow the same path, games will become (again) a secundary market; with (how in comics) smaller companies doing games for gamers but don't have much space in market and the biggest making games for themself (doing what they want to fuk the consumer). And we are in another time, today the money don't matter anymore for the biggest, after all, they are being paid out to make politics and not games/comics anymore. And with the censorship thats is being implanted, every product thats get out of the politics the biggest are propagating (including marketing methods) will be vanish. Or player wake up for it, or there will be no turning back... who complained about DLCs in the 2000's know what I saying.
    4. etholas
      etholas
      • supporter
      • 54 kudos
      The golden age has come and gone. Money became the focus. Gaming, games for gamers by gamers is a thing of the past. Now you are a product and a source of revenue, no longer valued or human. You are a whale, a wallet, money, a resource to exploit. No longer a person, but a statistic. A demographic.
    5. HannaVictoria
      HannaVictoria
      • supporter
      • 15 kudos
      @ LoganPP Comsumers? Who said anything about consumers? I meant fans that happen to agree with whoever's writing the book at the moment. The Inmates are Running the Asylum, My Dude. And sometimes their brainworms tell them Spidey needs to make a deal with Satan... i don't know. That same idiot champion what became the MCU, so *big shrug*?

      @driftscape You just described the comic bubble. And the housing bubble. And the South Seas Bubble. Or the Tulip Market (yes, this was a real thing). Really most bubble markets are like that until they go pop.
      ...What I'm saying is, you *may* want sell your gaming stocks sooner than later... but slowly, don't spook them. Panic selling is how the End always starts.
      I should point out, *I'm not an expert*. A student of history, no more or less. Industries go through these life cycles all the time. Have at least as long as we've had the concept of a Corporation.
      Though you are right, its not niche. People aren't buying video games for resale and never taking them out of the package. So maybe its closer to the time Hollywood as a whole nearly bankrupted itself back in the 60s?
      Regardless, something-probably an avalanche of somethings is going to break at some point (probably soon?) and break badly enough that it changes the industries landscape.
  9. 54yeggan
    54yeggan
    • BANNED
    • 42 kudos
    Holy chit. Like, holy actual. This is beyond crazy. Never heard of an exploit in-game this bad since the GTA Online SinglePlayer doxxing exploit incident.
    1. deathclawbaby
      deathclawbaby
      • supporter
      • 0 kudos
      Most things can be exploited via this method. It's likely that CDPR had saves be so modifiable for the sake of modders and went just a tad too far in order to accommodate modding without tools. I'd be more worried about your emails.
  10. Rexzone
    Rexzone
    • member
    • 0 kudos

    I have a question and the preset that are editors of Cybercat saves
    , can it also be vulnerable?
    example 
    https://www.nexusmods.com/cyberpunk2077/mods/1082?tab=stats
    1. Pickysaurus
      Pickysaurus
      • Community Manager
      • 649 kudos
      The Cybercat tool (and by extension it's presets) don't appear to be capable of doing anything malicious.
  11. anton6732
    anton6732
    • supporter
    • 2 kudos
    So when you play it, it isn't your doing. It's somebody close launches {'quickhack:distact_enemies()}!