CVE-2025-9809CWE-787

Out-of-bounds write in cdfs_open_cue_track in libretro libretro-common latest on all platforms allows remote attackers to execute arbitrary code via a crafted…

High · published September 1, 2025

CVSS v4.0
8.4
EPSS
0%
Percentile
35.6
In the wild
Unconfirmed
What it is

⚡ An out-of-bounds write vulnerability allows attackers to execute arbitrary code through a crafted .cue file that's longer than the expected path! 🚨 Think of it like trying to shove a giant package into a mailbox that's way too small — when it doesn't fit, things get broken and all sorts of chaos can happen! An attacker could exploit this vulnerability to execute malicious code on your system, potentially taking full control over it. Imagine a hacker opening the door to your computer and doing anything they want, like stealing data or installing malware — that’s a huge risk!

Put simply

Think of it like trying to shove a giant package into a mailbox that's way too small — when it doesn't fit, things get broken and all sorts of chaos can happen! This vulnerability occurs in the `cdfs_open_cue_track` function of the libretro-common library. It allows an out-of-bounds write due to improper handling of .cue file paths that exceed the maximum length, leading to code execution via a fixed-size buffer overflow.

What to do

An attacker could exploit this vulnerability to execute malicious code on your system, potentially taking full control over it. Imagine a hacker opening the door to your computer and doing anything they want, like stealing data or installing malware — that’s a huge risk! To mitigate this vulnerability, update libretro-common to the latest version as soon as possible. Additionally, ensure that your systems have proper input validation to prevent similar issues in the future. You've got this! By following these steps, you’ll be one step closer to securing your system! 🛡️

The record
Technical detail
CVSS v4.0
8.4 · HIGH
Vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00424 · 35.6th percentile
Weakness
CWE-787 · Out-of-bounds Write
Published
2025-09-01T18:38Z
EPSS history
Timeline
  • 01 SEP 18:38Z
    Out-of-bounds write in cdfs_open_cue_track in libretro libretro-common latest on all platforms allows remote attackers to execute arbitrary code via a crafted…
    cvelistv5