CVE-2025-67749
Out-of-Bounds Read in PCSX2 CDVD Handlers via Crafted ELF
Publication date: 2025-12-12
Last updated on: 2025-12-12
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| pcsx2 | pcsx2 | 2.5.377 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-125 | The product reads data past the end, or before the beginning, of the intended buffer. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in PCSX2 versions 2.5.377 and below involves an unchecked offset and size used in a memcpy operation within the CDVD SCMD 0x91 and SCMD 0x8F handlers. A specially crafted disc image or ELF file can exploit this to cause an out-of-bounds read from the emulator's memory. Specifically, the offset and size are controlled through MG header fields, allowing the crafted ELF to read data beyond the bounds of the mg_buffer and have it reflected back into emulated memory. This issue is fixed in version 2.5.378.
How can this vulnerability impact me? :
The vulnerability can lead to an out-of-bounds read from the emulator's memory, potentially exposing sensitive data from the emulator's memory space. This could allow an attacker to access information they should not have access to, possibly leading to information disclosure or other security issues within the emulated environment.
What immediate steps should I take to mitigate this vulnerability?
Update PCSX2 to version 2.5.378 or later, as this version contains the fix for the vulnerability involving unchecked memcpy operations in CDVD SCMD 0x91 and SCMD 0x8F handlers.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability is specific to the PCSX2 emulator's handling of specially crafted disc images or ELF files that cause out-of-bounds reads in memory. Detection involves monitoring or analyzing the use of PCSX2 versions 2.5.377 and below, especially when loading untrusted or malicious disc images or ELF files. Since the issue arises from unsafe memcpy operations in the cdvdWrite16 function triggered by SCMD commands 0x91 and 0x8F, one way to detect exploitation attempts is to monitor PCSX2 logs or debug output for abnormal memory access or crashes related to these commands. There are no specific network commands or system commands provided in the resources to detect this vulnerability directly. Users are advised to update to version 2.5.378 where the issue is fixed and avoid running untrusted homebrew software. For detection, one could use debugging tools or memory analysis tools to trace calls to cdvdWrite16 and check for out-of-bounds memory reads, but no explicit commands are given in the resources. [1, 3]