GOG Galaxy 2.0.0.2 suffers from Missing SSL Certificate Validation. An attacker who controls the local network, DNS, or a proxy can perform a man-in-the-middle (MitM) attack to intercept update requests and replace installer or update packages with malicious files.
References
| Link | Resource |
|---|---|
| https://www.notion.so/CVE-2025-56232-2a04e9f2a40d80dab203e39b5c9462f6 | Exploit Third Party Advisory |
| https://youtu.be/WchHCmqGaFQ | Exploit |
Configurations
History
09 Jan 2026, 17:54
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://www.notion.so/CVE-2025-56232-2a04e9f2a40d80dab203e39b5c9462f6 - Exploit, Third Party Advisory | |
| References | () https://youtu.be/WchHCmqGaFQ - Exploit | |
| First Time |
Cdprojekt gog Galaxy
Cdprojekt |
|
| CPE | cpe:2.3:a:cdprojekt:gog_galaxy:2.0.0.2:*:*:*:*:*:*:* |
06 Nov 2025, 22:15
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.8 |
| CWE | CWE-599 |
05 Nov 2025, 19:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-11-05 19:16
Updated : 2026-01-09 17:54
NVD link : CVE-2025-56232
Mitre link : CVE-2025-56232
CVE.ORG link : CVE-2025-56232
JSON object : View
Products Affected
cdprojekt
- gog_galaxy
CWE
CWE-599
Missing Validation of OpenSSL Certificate