PT-2025-35357 · Unknown+1 · Mupen64Plus+1

Gangyang Li · Published 2025-08-30 · Updated 2025-09-02 · CVE-2025-9688

Positive Technologies (AI Summary)

CVSS v2.0

5.1

Medium

Base vector

AV:N/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Mupen64Plus versions through 2.6.0

Description A security issue has been identified in Mupen64Plus. The write is viewer function within the src/device/cart/is viewer.c file is susceptible to an integer overflow. This issue can be initiated remotely and is considered to have high complexity with difficult exploitability. The exploit has been publicly disclosed. The vendor was informed of this disclosure but did not respond.

Recommendations Update Mupen64Plus to a version newer than 2.6.0. As a temporary workaround, consider restricting access to the write is viewer function until a patch is available.

Exploit

Fix

Integer Overflow

Weakness Enumeration

CWE-190

CWE-189

Related Identifiers

CVE-2025-9688

OPENSUSE-SU-2025:15513-1

Affected Products

Debian

Mupen64Plus

References · 16

• 🔥 https://github.com/Giles-one/mupen64plusEscape/tree/main/BUG10 · Exploit
• https://github.com/mupen64plus/mupen64plus-core/commit/3984137fc0c44110f1ef876adb008885b05a6e18 · Patch
• https://osv.dev/vulnerability/openSUSE-SU-2025:15513-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-9688 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-9688 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-9688 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-9688 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-9688 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-9688 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-9688 · Security Note
• https://suse.com/security/cve/CVE-2025-9688 · Note
• https://vuldb.com/?ctiid.321900 · Note
• https://vuldb.com/?submit.638592 · Note
• https://twitter.com/VulmonFeeds/status/1961786942355358204 · Twitter Post
• https://t.me/CVEtracker/31322 · Telegram Post