{"id":"CVE-2025-14308","aliases":["DEBIAN-CVE-2025-14308","EUVD-2025-201906","GHSA-jqf9-28w7-q25g","UBUNTU-CVE-2025-14308","USN-8385-1"],"status":"published","title":"Integer Overflow in Robocode's Buffer Write Method","description":"An integer overflow vulnerability exists in the write method of the Buffer class in Robocode version 1.9.3.6. The method fails to properly validate the length of data being written, allowing attackers to cause an overflow, potentially leading to buffer overflows and arbitrary code execution. This vulnerability can be exploited by submitting specially crafted inputs that manipulate the data length, leading to potential unauthorized code execution.","severity":{"version":"4.0","score":10,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/AU:Y/R:U/V:D/RE:M/U:Red","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00612,"percentile":0.49793,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-190"],"published":"2025-12-09T07:44:34Z","modified":"2026-10-17T12:57:00Z","fixes":[{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"robocode","fixed_in":["1.9.2.5-2ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"robocode","fixed_in":["1.9.3.1-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"robocode","fixed_in":["1.9.3.7-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"robocode","fixed_in":["1.9.3.9-2ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:24.04:LTS","package":"robocode","fixed_in":["1.9.3.9-3ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:26.04:LTS","package":"robocode","fixed_in":["1.9.3.9-4ubuntu0.26.04.1~esm1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"robocode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.9.3.9-3","1.9.3.9-4","1.9.3.9-5"]},{"source":"osv","ecosystem":"Debian:13","package":"robocode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.9.3.9-4","1.9.3.9-5"]},{"source":"osv","ecosystem":"Debian:14","package":"robocode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.9.3.9-4","1.9.3.9-5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"robocode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.2.5-2ubuntu0.1~esm1"}]}],"versions":["1.9.2.4-2","1.9.2.5-1","1.9.2.5-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"robocode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.3.1-1ubuntu0.1~esm1"}]}],"versions":["1.9.2.6-3","1.9.3.1-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"robocode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.3.7-1ubuntu0.1~esm1"}]}],"versions":["1.9.3.5-1","1.9.3.7-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"robocode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.3.9-2ubuntu0.1~esm1"}]}],"versions":["1.9.3.9-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"robocode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.3.9-3ubuntu0.1~esm1"}]}],"versions":["1.9.3.9-3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"robocode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.9.3.9-4"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"robocode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.9.3.9-4build1","1.9.3.9-5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"robocode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.3.9-4ubuntu0.26.04.1~esm1"}]}],"versions":["1.9.3.9-4","1.9.3.9-4build1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"robocode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.2.5-2ubuntu0.1~esm1"}]}],"versions":["1.9.2.4-2","1.9.2.5-1","1.9.2.5-2"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"robocode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.3.1-1ubuntu0.1~esm1"}]}],"versions":["1.9.2.6-3","1.9.3.1-1"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"robocode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.3.7-1ubuntu0.1~esm1"}]}],"versions":["1.9.3.5-1","1.9.3.7-1"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"robocode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.3.9-2ubuntu0.1~esm1"}]}],"versions":["1.9.3.9-2"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"robocode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.3.9-3ubuntu0.1~esm1"}]}],"versions":["1.9.3.9-3"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"robocode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.3.9-4ubuntu0.26.04.1~esm1"}]}],"versions":["1.9.3.9-4","1.9.3.9-4build1"],"bundled":4}],"products":[{"vendor":"robocode","product":"robocode"},{"vendor":"robocode project","product":"robocode"}],"references":[{"url":"https://github.com/robo-code/robocode/pull/70","tags":["Issue Tracking","Vendor Advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-14308"},{"url":"https://github.com/advisories/GHSA-jqf9-28w7-q25g"},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-14308","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-14308","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-14308","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8385-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-10648","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-14306","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-14307","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2025-14308","title":"Integer Overflow in Robocode's Buffer Write Method","description":"An integer overflow vulnerability exists in the write method of the Buffer class in Robocode version 1.9.3.6. The method fails to properly validate the length of data being written, allowing attackers to cause an overflow, potentially leading to buffer overflows and arbitrary code execution. This vulnerability can be exploited by submitting specially crafted inputs that manipulate the data length, leading to potential unauthorized code execution.","status":"published","published":"2025-12-09T07:44:34.003Z","modified":"2025-12-09T14:39:50.288Z","cvss":[{"version":"4.0","score":10,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/AU:Y/R:U/V:D/RE:M/U:Red","level":"critical","assessor":"cna"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T14:32:28.250136Z"}],"euvd":[{"id":"EUVD-2025-201906","description":"An integer overflow vulnerability exists in the write method of the Buffer class in Robocode version 1.9.3.6. The method fails to properly validate the length of data being written, allowing attackers to cause an overflow, potentially leading to buffer overflows and arbitrary code execution. This vulnerability can be exploited by submitting specially crafted inputs that manipulate the data length, leading to potential unauthorized code execution.","status":"published","published":"2025-12-09T07:44:34Z","modified":"2025-12-09T14:39:50Z","cvss":[{"version":"4.0","score":10,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/AU:Y/R:U/V:D/RE:M/U:Red","level":"critical"}],"updated_at":"2026-11-02T19:49:08.541096Z"}],"ghsa":[{"id":"GHSA-jqf9-28w7-q25g","title":"An integer overflow vulnerability exists in the write method of the Buffer class in Robocode...","description":"An integer overflow vulnerability exists in the write method of the Buffer class in Robocode version 1.9.3.6. The method fails to properly validate the length of data being written, allowing attackers to cause an overflow, potentially leading to buffer overflows and arbitrary code execution. This vulnerability can be exploited by submitting specially crafted inputs that manipulate the data length, leading to potential unauthorized code execution.","status":"published","published":"2025-12-09T18:30:35Z","modified":"2026-01-05T18:31:28Z","cvss":[{"version":"4.0","score":10,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:D/RE:M/U:Red","level":"critical"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T15:05:29.894873Z"}],"nvd":[{"id":"CVE-2025-14308","description":"An integer overflow vulnerability exists in the write method of the Buffer class in Robocode version 1.9.3.6. The method fails to properly validate the length of data being written, allowing attackers to cause an overflow, potentially leading to buffer overflows and arbitrary code execution. This vulnerability can be exploited by submitting specially crafted inputs that manipulate the data length, leading to potential unauthorized code execution.","status":"published","published":"2025-12-09T16:17:38.797Z","modified":"2026-10-15T19:10:00.173Z","cvss":[{"version":"4.0","score":10,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:D/RE:M/U:Red","level":"critical","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T14:11:49.093461Z"}],"osv":[{"id":"CVE-2025-14308","description":"An integer overflow vulnerability exists in the write method of the Buffer class in Robocode version 1.9.3.6. The method fails to properly validate the length of data being written, allowing attackers to cause an overflow, potentially leading to buffer overflows and arbitrary code execution. This vulnerability can be exploited by submitting specially crafted inputs that manipulate the data length, leading to potential unauthorized code execution.","status":"published","published":"2025-12-09T16:17:38.797Z","modified":"2026-04-10T05:21:28.727723Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:46.340268Z"},{"id":"DEBIAN-CVE-2025-14308","description":"An integer overflow vulnerability exists in the write method of the Buffer class in Robocode version 1.9.3.6. The method fails to properly validate the length of data being written, allowing attackers to cause an overflow, potentially leading to buffer overflows and arbitrary code execution. This vulnerability can be exploited by submitting specially crafted inputs that manipulate the data length, leading to potential unauthorized code execution.","status":"published","published":"2025-12-09T16:17:38.797Z","modified":"2026-10-16T09:47:27.193888075Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:45.102284Z"},{"id":"UBUNTU-CVE-2025-14308","description":"An integer overflow vulnerability exists in the write method of the Buffer class in Robocode version 1.9.3.6. The method fails to properly validate the length of data being written, allowing attackers to cause an overflow, potentially leading to buffer overflows and arbitrary code execution. This vulnerability can be exploited by submitting specially crafted inputs that manipulate the data length, leading to potential unauthorized code execution.","status":"published","published":"2025-12-09T16:17:00Z","modified":"2026-10-17T12:57:00.949205649Z","cvss":[{"version":"4.0","score":10,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/AU:Y/R:U/V:D/RE:M/U:Red","level":"critical"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T16:55:20.144818Z"},{"id":"USN-8385-1","title":"robocode vulnerabilities","description":"It was discovered that Robocode could be tricked into making network\nrequests to attacker-controlled systems. An attacker could possibly use\nthis issue to cause external service interaction, resulting in\ninformation disclosure. This issue only affected Ubuntu 16.04 LTS and\nUbuntu 18.04 LTS. (CVE-2019-10648)\n\nLim Sim Yee discovered that Robocode did not properly validate file\npaths in the CacheCleaner component. An attacker could possibly use this\nissue to delete arbitrary files. (CVE-2025-14306)\n\nLim Sim Yee discovered that Robocode did not securely create temporary\nfiles in the AutoExtract component. An attacker could possibly use this\nissue to manipulate temporary files, resulting in arbitrary code\nexecution. (CVE-2025-14307)\n\nLim Sim Yee discovered that Robocode did not properly validate data\nlengths in the Buffer class. An attacker could possibly use this issue\nto trigger an integer overflow, resulting in arbitrary code execution.\n(CVE-2025-14308)","status":"published","published":"2026-06-04T13:59:44Z","modified":"2026-06-04T23:03:42.629564035Z","updated_at":"2026-11-02T16:58:25.103481Z"}]}}