CVE-2025-34449: Genymobile/scrcpy <= 3.3.3 Global Buffer Overflow
Genymobile/scrcpy versions up to and including 3.3.3, prior to commit 3e40b24, contain a buffer overflow vulnerability in the scdevicemsgdeserialize() function. A compromised device can send crafted messages that cause out-of-bounds reads, which may result in memory corruption or a denial-of-service condition. This vulnerability may allow further exploitation on the host system.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2025-34449?
CVE-2025-34449 is classified as a critical vulnerability due to its potential to cause a global buffer overflow.
How do I fix CVE-2025-34449?
To mitigate CVE-2025-34449, upgrade to scrcpy version 3.4.0 or later, which includes the necessary patches.
What versions are affected by CVE-2025-34449?
CVE-2025-34449 affects scrcpy versions up to and including 3.3.3.
What component of scrcpy is vulnerable in CVE-2025-34449?
The vulnerability in CVE-2025-34449 resides in the sc_read32be function accessed via sc_device_msg_deserialize and process_msgs.
What kind of attack can exploit CVE-2025-34449?
CVE-2025-34449 can be exploited by processing crafted device messages that trigger reads beyond allocated memory.