I won’t be surprised at all if they are filled with vulnerabilities.
Look at "(s)elf-exploitation"
CVE #: Common Vulnerabilities and Exposures number, assigned by the MITRE Corporation
For a Remote Code Execution bug like this it only makes sense if it's a popular multiplayer game, so that there are enough targets to be worth attacking, for long enough after release that you can identify a bug and figure out how to abuse it.
GTA V is like a decade old at this point, there a very few games with that sort of longevity, we're talking Minecraft, WoW, big hits rather than the average video game.
For those curious, mod menus are what "hackers" use to exploit the gameplay for fun. Script-kiddies are a good analog in history. They're often just kids who googled GTA hacks and installed from the first page they thought looked cool. They'll be prime targets for distribution.
> CVE-2023-24059
What other video games have had CVE's?
There's actually been a lot more of these that don't get CVEs It's one of the reasons I prefer to game in a VM with heavy network filtering and egress only through VPN
There is little to no care from game developers about security, games with actively exploitable RCEs (see pretty much the whole CoD franchise) are just allowed to stay up on Steam
Gamers are also kinda dumb and oblivious to RATs etc which doesn't help
They took the online servers offline in January and to their credit they patched a 6 year old game and brought the servers back in September.
A bunch of first-party Nintendo Switch, Wii U, and 3DS games had a buffer overflow bug in a shared netcode library ("enl") which can be exploited by a remote attacker just by connecting to them in online play.
Affected titles included Mario Kart 7, Mario Kart 8, Mario Kart 8 Deluxe, Splatoon, Splatoon 2, Splatoon 3, ARMS, Super Mario Maker 2, and Nintendo Switch Sports. (The Wii U games remain unpatched.)
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-2081...
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1071...
GTA V has been around for ten years but still has a huge player base and that's what makes this practical.
The general recommendation is to install a community patch but I'd rather not run it at all, to be honest. I'd say "play in a VM" but I'm sure anti-cheat wouldn't like that.
For mouse and keyboard I just use the evdev forwarding thing where you press both ctrl keys to swap between host and guest
https://wiki.archlinux.org/title/PCI_passthrough_via_OVMF
With AMD cards it's relatively easy if you're willing to install two cards and have one of them just sit there doing nothing when you're not using the VM. It's also possible to use just one card and detach it from the host system, pass it to the VM, and then reattach back to the host system when you're done playing, although I spent multiple days on this and never got it working. YMMV, it was 2-3 years ago, the driver support may have improved.
With nvidia it ranges from difficult to impossible.
Obviously, it means you can't use DLSS, RT, or any other GPU-specific features, but their DirectX virtualization supports up to DX12.
It's mostly those annoying ACs with kernel modules like EAC, BattlEye, ESEA etc. that do anti VM in an attempt to prevent cheat devs from 1. debugging the AC without at least a little effort and 2. having a clean OS but reading guest RAM from the host to avoid the anticheat entirely