CVE-2025-9136 libretro RetroArch file_stream.c filestream_vscanf out-of-bounds
MediumCVSS 4.8
EPSS 0.22%
- Published
- Updated
- Exploit status
- No public exploit known
Description
A flaw has been found in libretro RetroArch 1.18.0/1.19.0/1.20.0. This affects the function filestream_vscanf of the file libretro-common/streams/file_stream.c. This manipulation causes out-of-bounds read. The attack needs to be launched locally. Upgrading to version 1.21.0 mitigates this issue. It is recommended to upgrade the affected component.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/retroarch(Debian:12) | All versions | No fix listed |
| debian/retroarch(Debian:12) | = 1.14.0+dfsg-1 | No fix listed |
| debian/retroarch(Debian:12) | = 1.15.0+dfsg-1 | No fix listed |
| debian/retroarch(Debian:12) | = 1.16.0.3+dfsg-1 | No fix listed |
| debian/retroarch(Debian:12) | = 1.18.0+dfsg-1 | No fix listed |
| debian/retroarch(Debian:12) | = 1.19.1+dfsg-1 | No fix listed |
| debian/retroarch(Debian:12) | = 1.20.0+dfsg-1 | No fix listed |
| debian/retroarch(Debian:12) | = 1.20.0+dfsg-2 | No fix listed |
| debian/retroarch(Debian:12) | = 1.20.0+dfsg-3 | No fix listed |
| debian/retroarch(Debian:12) | = 1.22.2+dfsg-1 | No fix listed |
| debian/retroarch(Debian:12) | = 1.22.2+dfsg-2 | No fix listed |
| debian/retroarch(Debian:13) | All versions | No fix listed |
| debian/retroarch(Debian:13) | = 1.20.0+dfsg-2 | No fix listed |
| debian/retroarch(Debian:13) | = 1.20.0+dfsg-3 | No fix listed |
| debian/retroarch(Debian:13) | = 1.22.2+dfsg-1 | No fix listed |
| debian/retroarch(Debian:13) | = 1.22.2+dfsg-2 | No fix listed |
| debian/retroarch(Debian:14) | < 1.20.0+dfsg-3 | 1.20.0+dfsg-3 |
| debian/retroarch(Debian:14) | = 1.20.0+dfsg-2 | No fix listed |
| libretro retroarch | = 1.18.0 | No fix listed |
| libretro retroarch | = 1.19.0 | No fix listed |
| libretro retroarch | = 1.20.0 | No fix listed |
| ubuntu/retroarch(Ubuntu:22.04) | All versions | No fix listed |
| ubuntu/retroarch(Ubuntu:24.04) | All versions | No fix listed |
| ubuntu/retroarch(Ubuntu:26.04) | All versions | No fix listed |
| ubuntu/retroarch(Ubuntu:26.10) | All versions | No fix listed |
References
- Debian Security Tracker CVE-2025-9136 vendor-advisory
- VDB-320516 | libretro RetroArch file_stream.c filestream_vscanf out-of-bounds technical-description third-party-advisory vdb-entry
- VDB-320516 | CTI Indicators (IOB, IOC, IOA) permissions-required signature vdb-entry
- Submit #617657 | libretro RetroArch v1.20.0/v1.19.0/v1.18.0 Out-of-Bounds Read exploit third-party-advisory vdb-entry
- github.com issue-tracking patch
- github.com issue-tracking patch
- github.com patch release-notes
- Ubuntu CVE tracker vendor-advisory
- www.cve.org
- bugs.debian.org issue-tracking