Critical · published December 19, 2025
⚠️ A sneaky buffer overflow lurks in Genymobile/scrcpy up to version 3.3.3! A compromised device can send crafty messages to trigger memory corruption or even a denial-of-service. 😱 Think of this like a faulty delivery service that misplaces packages—one wrong message can overflow and cause chaos in the system's memory, just like a delivery mishap can disrupt your day. If exploited, this vulnerability could lead to memory corruption, potentially crashing the service or causing unexpected behavior. While it isn't actively exploited yet, the door is open for future attacks, leaving your system vulnerable to unwanted surprises.
Think of this like a faulty delivery service that misplaces packages—one wrong message can overflow and cause chaos in the system's memory, just like a delivery mishap can disrupt your day. This buffer overflow vulnerability in the sc_device_msg_deserialize() function allows crafted messages to trigger out-of-bounds reads, which can compromise the integrity of the memory or even crash the host system.
If exploited, this vulnerability could lead to memory corruption, potentially crashing the service or causing unexpected behavior. While it isn't actively exploited yet, the door is open for future attacks, leaving your system vulnerable to unwanted surprises. Update immediately to version 3.3.4 or later to patch this vulnerability. Regularly review your scrcpy instance for updates, and ensure that only trusted devices can communicate with your system. You've got this! Follow these steps, and you'll keep your system safe and sound. 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| genymotion/scrcpy | < 3.3.4 | 3.3.4 |