PT-2025-52351 · Genymobile · Scrcpy

Marlinkcyber · Published 2025-12-18 · Updated 2026-01-03 · CVE-2025-34449

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions Genymobile/scrcpy versions up to and including 3.3.3

Description The software contains a global buffer overflow issue within the sc read32be function, which is called by sc device msg deserialize() and process msgs(). Processing specially crafted device messages can lead to reading beyond the allocated memory for a global buffer, potentially causing memory corruption or application crashes. This can result in a denial of service, and depending on the system setup and protections in place, could potentially be used for more serious exploitation.

Recommendations Update to a version later than 3.3.3 and after commit 3e40b24.

Exploit

Fix

DoS

Deserialization of Untrusted Data

Buffer Overflow

Weakness Enumeration

CWE-502

CWE-119

Related Identifiers

CVE-2025-34449

Affected Products

Scrcpy

References · 14

• 🔥 https://github.com/marlinkcyber/advisories/blob/main/advisories/MCSAID-2025-003-scrcpy-global-buffer-overflow.md · Exploit
• https://github.com/Genymobile/scrcpy/commit/3e40b24 · Patch
• https://github.com/Genymobile/scrcpy/issues/6415 · Patch
• https://osv.dev/vulnerability/CVE-2025-34449 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-34449 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-34449 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-34449 · Security Note
• https://cve.org/CVERecord?id=CVE-2025-34449 · Security Note
• https://t.me/cveNotify/146567 · Telegram Post
• https://t.me/cveNotify/147641 · Telegram Post
• https://vulncheck.com/advisories/genymobile-scrcpy-global-buffer-overflow · Note
• https://twitter.com/VulmonFeeds/status/2001951454358024464 · Twitter Post
• https://t.me/cveNotify/147355 · Telegram Post
• https://twitter.com/CVEnew/status/2002104280870687078 · Twitter Post