diff --git a/games/teeworlds/Makefile b/games/teeworlds/Makefile
index 334ce2ee286e..822217270989 100644
--- a/games/teeworlds/Makefile
+++ b/games/teeworlds/Makefile
@@ -1,58 +1,58 @@
 PORTNAME=	teeworlds
 PORTVERSION=	0.7.5
-PORTREVISION=	1
+PORTREVISION=	2
 CATEGORIES=	games
 
 MAINTAINER=	amdmi3@FreeBSD.org
 COMMENT=	Platform game featuring buggers equipped with weapons
 
 LICENSE=	ZLIB
 LICENSE_FILE=	${WRKSRC}/license.txt
 
 USE_GITHUB=	yes
 GH_TUPLE=	teeworlds:teeworlds-translation:4ed69dd:translations/datasrc/languages \
 		teeworlds:teeworlds-maps:1d3401a:maps/datasrc/maps
 
 USES=		cmake cpe pkgconfig python ssl
 USE_CSTD=	c99
 CPE_VERSION=	${PORTVERSION:C/^0\.//}
 CMAKE_ARGS=	-DPYTHON_EXECUTABLE="${PYTHON_CMD}"
 
 PLIST_FILES=	bin/${PORTNAME}_srv
 PORTDATA=	*
 
 OPTIONS_DEFINE=		CLIENT TEST
 OPTIONS_DEFAULT=	CLIENT TEST
 
 CLIENT_DESC=		Build game client
 CLIENT_CMAKE_BOOL=	CLIENT
 CLIENT_USES=		gl sdl xorg
 CLIENT_USE=		GL=gl XORG=x11 SDL=sdl2
 CLIENT_LIB_DEPENDS=	libfreetype.so:print/freetype2 \
 			libwavpack.so:audio/wavpack \
 			libpnglite.so:graphics/pnglite
 CLIENT_PLIST_FILES=	bin/${PORTNAME}
 
 TEST_BUILD_DEPENDS=	googletest>=0:devel/googletest
 TEST_TEST_TARGET=	run_tests
 
 post-extract:
 	@${RM} -r ${WRKSRC}/src/engine/external/wavpack
 	@${RM} -r ${WRKSRC}/src/engine/external/pnglite
 	@${RM} -r ${WRKSRC}/src/engine/external/zlib
 
 post-patch:
 	@${REINPLACE_CMD} -e '/find_package.*Git/ d' ${WRKSRC}/CMakeLists.txt
 
 post-patch-CLIENT-off:
 	@${REINPLACE_CMD} -e '/find_package.*Pnglite/ d' ${WRKSRC}/CMakeLists.txt
 	@${REINPLACE_CMD} -e '/find_package.*Wavpack/ d' ${WRKSRC}/CMakeLists.txt
 	@${REINPLACE_CMD} -e '/find_package.*SDL2/ d' ${WRKSRC}/CMakeLists.txt
 	@${REINPLACE_CMD} -e '/find_package.*Freetype/ d' ${WRKSRC}/CMakeLists.txt
 	@${REINPLACE_CMD} -e '/find_package.*OpenGL/ d' ${WRKSRC}/CMakeLists.txt
 	@${REINPLACE_CMD} -e '/find_package.*X11/ d' ${WRKSRC}/CMakeLists.txt
 
 post-patch-TEST-off:
 	@${REINPLACE_CMD} -e '/find_package.*GTest/ d' ${WRKSRC}/CMakeLists.txt
 
 .include <bsd.port.mk>
diff --git a/games/teeworlds/files/patch-CVE-2021-43518 b/games/teeworlds/files/patch-CVE-2021-43518
new file mode 100644
index 000000000000..b7cd56cd9e69
--- /dev/null
+++ b/games/teeworlds/files/patch-CVE-2021-43518
@@ -0,0 +1,42 @@
+commit 91e5492d4c210f82f1ca6b43a73417fef5463368
+Author: Robert Müller <robert.mueller@uni-siegen.de>
+Date:   Sat Jan 15 17:36:39 2022 +0100
+
+    hotfix CVE-2021-43518
+
+diff --git src/game/client/components/maplayers.cpp src/game/client/components/maplayers.cpp
+index 24d09509..bbaaa821 100644
+--- src/game/client/components/maplayers.cpp
++++ src/game/client/components/maplayers.cpp
+@@ -175,7 +175,7 @@ void CMapLayers::LoadEnvPoints(const CLayers *pLayers, array<CEnvPoint>& lEnvPoi
+ 				p.m_Time = pEnvPoint_v1->m_Time;
+ 				p.m_Curvetype = pEnvPoint_v1->m_Curvetype;
+ 
+-				for(int c = 0; c < pItem->m_Channels; c++)
++				for(int c = 0; c < minimum(pItem->m_Channels, 4); c++)
+ 				{
+ 					p.m_aValues[c] = pEnvPoint_v1->m_aValues[c];
+ 					p.m_aInTangentdx[c] = 0;
+diff --git src/game/editor/io.cpp src/game/editor/io.cpp
+index 160bb1c6..2bedb06e 100644
+--- src/game/editor/io.cpp
++++ src/game/editor/io.cpp
+@@ -479,7 +479,8 @@ int CEditorMap::Load(class IStorage *pStorage, const char *pFileName, int Storag
+ 			for(int e = 0; e < Num; e++)
+ 			{
+ 				CMapItemEnvelope *pItem = (CMapItemEnvelope *)DataFile.GetItem(Start+e, 0, 0);
+-				CEnvelope *pEnv = new CEnvelope(pItem->m_Channels);
++				const int Channels = minimum(pItem->m_Channels, 4);
++				CEnvelope *pEnv = new CEnvelope(Channels);
+ 				pEnv->m_lPoints.set_size(pItem->m_NumPoints);
+ 				for(int n = 0; n < pItem->m_NumPoints; n++)
+ 				{
+@@ -496,7 +497,7 @@ int CEditorMap::Load(class IStorage *pStorage, const char *pFileName, int Storag
+ 						pEnv->m_lPoints[n].m_Time = pEnvPoint_v1->m_Time;
+ 						pEnv->m_lPoints[n].m_Curvetype = pEnvPoint_v1->m_Curvetype;
+ 
+-						for(int c = 0; c < pItem->m_Channels; c++)
++						for(int c = 0; c < Channels; c++)
+ 						{
+ 							pEnv->m_lPoints[n].m_aValues[c] = pEnvPoint_v1->m_aValues[c];
+ 						}