Vulnerability Description
Genymobile/scrcpy versions up to and including 3.3.3, prior to commit 3e40b24, contain a buffer overflow vulnerability in the sc_device_msg_deserialize() function. A compromised device can send crafted messages that cause out-of-bounds reads, which may result in memory corruption or a denial-of-service condition. This vulnerability may allow further exploitation on the host system.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Genymotion | Scrcpy | < 3.3.4 |
Related Weaknesses (CWE)
References
- https://github.com/Genymobile/scrcpy/commit/3e40b24Patch
- https://github.com/Genymobile/scrcpy/issues/6415ExploitIssue TrackingPatch
- https://github.com/marlinkcyber/advisories/blob/main/advisories/MCSAID-2025-003-ExploitThird Party Advisory
- https://www.vulncheck.com/advisories/genymobile-scrcpy-global-buffer-overflowThird Party Advisory
- https://github.com/marlinkcyber/advisories/blob/main/advisories/MCSAID-2025-003-ExploitThird Party Advisory
FAQ
What is CVE-2025-34449?
CVE-2025-34449 is a vulnerability with a CVSS score of 9.1 (CRITICAL). Genymobile/scrcpy versions up to and including 3.3.3, prior to commit 3e40b24, contain a buffer overflow vulnerability in the sc_device_msg_deserialize() function. A compromised device can send crafte...
How severe is CVE-2025-34449?
CVE-2025-34449 has been rated CRITICAL with a CVSS base score of 9.1/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2025-34449?
Check the references section above for vendor advisories and patch information. Affected products include: Genymotion Scrcpy.