One unchecked player number in a name packet lets a rogue host take over a joining player's game. The report covers the GOG copy on Windows 10 and doesn't say whether a patch exists.