Description
Genymobile/scrcpy versions up to and including 3.3.3, prior to commit 3e40b24, contain a buffer overflow vulnerability in the sc_device_msg_deserialize() function. A compromised device can send crafted messages that cause out-of-bounds reads, which may result in memory corruption or a denial-of-service condition. This vulnerability may allow further exploitation on the host system.
Published: 2025-12-18
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 03 Jan 2026 21:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-119

Wed, 31 Dec 2025 17:45:00 +0000

Type Values Removed Values Added
First Time appeared Genymotion
Genymotion scrcpy
Weaknesses CWE-502
CPEs cpe:2.3:a:genymotion:scrcpy:*:*:*:*:*:*:*:*
Vendors & Products Genymotion
Genymotion scrcpy
Metrics cvssV3_1

{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H'}

Mon, 22 Dec 2025 18:00:00 +0000

Type Values Removed Values Added
Description Genymobile/scrcpy versions up to and including 3.3.3 and prior to commit 3e40b24 contain a global buffer overflow vulnerability in the function sc_read32be, invoked via sc_device_msg_deserialize() and process_msgs(). Processing crafted device messages can cause reads beyond the bounds of a global buffer, leading to memory corruption or crashes. This vulnerability can be exploited to cause a denial of service and, under certain conditions, may be leveraged for further exploitation depending on the execution environment and available mitigations. Genymobile/scrcpy versions up to and including 3.3.3, prior to commit 3e40b24, contain a buffer overflow vulnerability in the sc_device_msg_deserialize() function. A compromised device can send crafted messages that cause out-of-bounds reads, which may result in memory corruption or a denial-of-service condition. This vulnerability may allow further exploitation on the host system.

Thu, 18 Dec 2025 22:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 18 Dec 2025 21:30:00 +0000

Type Values Removed Values Added
Description Genymobile/scrcpy versions up to and including 3.3.3 and prior to commit 3e40b24 contain a global buffer overflow vulnerability in the function sc_read32be, invoked via sc_device_msg_deserialize() and process_msgs(). Processing crafted device messages can cause reads beyond the bounds of a global buffer, leading to memory corruption or crashes. This vulnerability can be exploited to cause a denial of service and, under certain conditions, may be leveraged for further exploitation depending on the execution environment and available mitigations.
Title Genymobile/scrcpy <= 3.3.3 Global Buffer Overflow
Weaknesses CWE-119
References
Metrics cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Genymotion Scrcpy
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-03-23T15:43:52.304Z

Reserved: 2025-04-15T19:15:22.602Z

Link: CVE-2025-34449

cve-icon Vulnrichment

Updated: 2025-12-18T21:38:58.958Z

cve-icon NVD

Status : Modified

Published: 2025-12-18T22:15:56.003

Modified: 2026-01-03T21:15:43.507

Link: CVE-2025-34449

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses