Every CVE Search/ Get API key

CVE-2025-67749

PCSX2 has an Out-of-bounds Read due to unchecked offset and size passed to memcpy

5.3 MediumFix available

PCSX2 is a free and open-source PlayStation 2 (PS2) emulator. In versions 2.5.377 and below, an unchecked offset and size used in a memcpy operation inside PCSX2's CDVD SCMD 0x91 and SCMD 0x8F handlers allow a specially crafted disc image or ELF to cause an out-of-bounds read from emulator memory. Because the offset and size is controlled through MG header fields, a specially crafted ELF can read data beyond the bounds of mg_buffer and have it reflected back into emulated memory. This issue is fixed in version 2.5.378.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Passive

What an attacker can affect

Confidentiality
Low
Integrity
None
Availability
Low

Exploit likelihood

0.34%Up 0.3 points since Dec 13, 2025
90%50%10%1%

What each source reports

CVE List Score used 5.3

PCSX2 has an Out-of-bounds Read due to unchecked offset and size passed to memcpy

PCSX2 is a free and open-source PlayStation 2 (PS2) emulator. In versions 2.5.377 and below, an unchecked offset and size used in a memcpy operation inside PCSX2's CDVD SCMD 0x91 and SCMD 0x8F handlers allow a specially crafted disc image or ELF to cause an out-of-bounds read from emulator memory. Because the offset and size is controlled through MG header fields, a specially crafted ELF can read data beyond the bounds of mg_buffer and have it reflected back into emulated memory. This issue is fixed in version 2.5.378.

Record
CVE-2025-67749
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N
Weakness
CWE-125
Updated
2026-11-02
EUVDEUVD-2025-203177 5.3

PCSX2 is a free and open-source PlayStation 2 (PS2) emulator. In versions 2.5.377 and below, an unchecked offset and size used in a memcpy operation inside PCSX2's CDVD SCMD 0x91 and SCMD 0x8F handlers allow a specially crafted disc image or ELF to cause an out-of-bounds read from emulator memory. Because the offset and size is controlled through MG header fields, a specially crafted ELF can read data beyond the bounds of mg_buffer and have it reflected back into emulated memory. This issue is fixed in version 2.5.378.

Record
EUVD-2025-203177
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N
Updated
2026-11-02
NVD 5.3

PCSX2 is a free and open-source PlayStation 2 (PS2) emulator. In versions 2.5.377 and below, an unchecked offset and size used in a memcpy operation inside PCSX2's CDVD SCMD 0x91 and SCMD 0x8F handlers allow a specially crafted disc image or ELF to cause an out-of-bounds read from emulator memory. Because the offset and size is controlled through MG header fields, a specially crafted ELF can read data beyond the bounds of mg_buffer and have it reflected back into emulated memory. This issue is fixed in version 2.5.378.

Record
CVE-2025-67749
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness
CWE-125
Updated
2026-11-02
OSV 5.3

PCSX2 has an Out-of-bounds Read due to unchecked offset and size passed to memcpy

PCSX2 is a free and open-source PlayStation 2 (PS2) emulator. In versions 2.5.377 and below, an unchecked offset and size used in a memcpy operation inside PCSX2's CDVD SCMD 0x91 and SCMD 0x8F handlers allow a specially crafted disc image or ELF to cause an out-of-bounds read from emulator memory. Because the offset and size is controlled through MG header fields, a specially crafted ELF can read data beyond the bounds of mg_buffer and have it reflected back into emulated memory. This issue is fixed in version 2.5.378.

Record
CVE-2025-67749
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N
Weakness
CWE-125
Updated
2026-11-02
OSVDEBIAN-CVE-2025-67749 5.3

PCSX2 is a free and open-source PlayStation 2 (PS2) emulator. In versions 2.5.377 and below, an unchecked offset and size used in a memcpy operation inside PCSX2's CDVD SCMD 0x91 and SCMD 0x8F handlers allow a specially crafted disc image or ELF to cause an out-of-bounds read from emulator memory. Because the offset and size is controlled through MG header fields, a specially crafted ELF can read data beyond the bounds of mg_buffer and have it reflected back into emulated memory. This issue is fixed in version 2.5.378.

Record
DEBIAN-CVE-2025-67749
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
OSVUBUNTU-CVE-2025-67749 5.3

PCSX2 is a free and open-source PlayStation 2 (PS2) emulator. In versions 2.5.377 and below, an unchecked offset and size used in a memcpy operation inside PCSX2's CDVD SCMD 0x91 and SCMD 0x8F handlers allow a specially crafted disc image or ELF to cause an out-of-bounds read from emulator memory. Because the offset and size is controlled through MG header fields, a specially crafted ELF can read data beyond the bounds of mg_buffer and have it reflected back into emulated memory. This issue is fixed in version 2.5.378.

Record
UBUNTU-CVE-2025-67749
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
pcsx2
Debian:12
All versions, plus listed versions
1.6.0+dfsg-21.6.0+dfsg-2.11.6.0+dfsg-31.6.0+dfsg-3.12.4.0+dfsg-1
Show 5 moreShow less
2.4.0+dfsg-22.6.3+dfsg-12.6.3+dfsg-22.8.2+dfsg-12.8.2+dfsg-2
None known
pcsx2
Debian:13
All versions, plus listed versions
1.6.0+dfsg-31.6.0+dfsg-3+deb13u11.6.0+dfsg-3.12.4.0+dfsg-12.4.0+dfsg-2
Show 4 moreShow less
2.6.3+dfsg-12.6.3+dfsg-22.8.2+dfsg-12.8.2+dfsg-2
None known
pcsx2
Debian:14
before 2.4.0+dfsg-1, plus listed versions
1.6.0+dfsg-31.6.0+dfsg-3.1
2.4.0+dfsg-1
pcsx2
Ubuntu:16.04:LTS
All versions, plus listed versions
1.3.1+dfsg-1build11.3.1-1094-gf062b0f+dfsg-11.3.1-1094-gf062b0f+dfsg-1build11.4.0+dfsg-1
None known
pcsx2
Ubuntu:18.04:LTS
All versions, plus listed versions
1.4.0+dfsg-2
None known
pcsx2
Ubuntu:20.04:LTS
All versions, plus listed versions
1.5.0~gfc1d9aef0+dfsg-11.5.0~gfc1d9aef0+dfsg-1ubuntu11.5.0~gfc1d9aef0+dfsg-2
None known
pcsx2
Ubuntu:22.04:LTS
All versions, plus listed versions
1.6.0+dfsg-11.6.0+dfsg-1build1
None known
pcsx2
Ubuntu:24.04:LTS
All versions, plus listed versions
1.6.0+dfsg-2build11.6.0+dfsg-2ubuntu11.6.0+dfsg-2ubuntu3
None known
pcsx2
Ubuntu:25.10
All versions, plus listed versions
1.6.0+dfsg-3
None known
pcsx2
Ubuntu:26.10
All versions, plus listed versions
2.6.3+dfsg-1build12.6.3+dfsg-22.6.3+dfsg-2build1
None known
pcsx2
Ubuntu:26.04:LTS
All versions, plus listed versions
1.6.0+dfsg-31.6.0+dfsg-3.12.4.0+dfsg-22.6.3+dfsg-12.6.3+dfsg-1build1
None known

History

History
RecordedChangedSources
first indexedCVE List, EUVD, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-67749 is a medium vulnerability (CVSS 5.3) in Pcsx2, published December 12, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.34%, the 28th percentile. Fixed in pcsx2 2.4.0+dfsg-1.

References

MoveEnter Open