CVE-2025-34449

Katalog CVE

CVSS 9.1 · Critical EPSS 0,42%

Kerentanan Deserialization of Untrusted Data pada genymotion scrcpy. Skor CVSS 3.1 9.1 (Critical) menurut NVD.

Deskripsi (NVD)

Genymobile/scrcpy versions up to and including 3.3.3, prior to commit 3e40b24, contain a buffer overflow vulnerability in the sc_device_msg_deserialize() function. A compromised device can send crafted messages that cause out-of-bounds reads, which may result in memory corruption or a denial-of-service condition. This vulnerability may allow further exploitation on the host system.

Rincian

Terbit di NVD

18 Desember 2025

Terakhir diubah

30 September 2026

Status NVD

Modified

CVSS 3.1

9.1 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-502: Deserialization of Untrusted Data

EPSS (30 hari)

0,42% peluang dieksploitasi; lebih tinggi dari 34,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/Genymobile/scrcpy/commit/3e40b24 patch
• https://github.com/Genymobile/scrcpy/issues/6415 exploit · issue tracking · patch
• https://github.com/marlinkcyber/advisories/blob/main/advisories/MCSAID-2025-003-scrcpy-global-buffer-overflow.... exploit · advisory pihak ketiga
• https://www.vulncheck.com/advisories/genymobile-scrcpy-global-buffer-overflow advisory pihak ketiga