← Back

Libretro

libretro

3 CVEs • 2 products

Products (2)

Click to collapse
Toggle
Retroarch
retroarch
2 CVEs
Libretro Common
libretro-common
1 CVE

CVEs (3)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2025-9809
1Libretro
1Libretro Common
Dec 8, 2025
Sep 1, 2025
8.4 HIGH· v4
9.8 CRITICAL· v3
N/A· v2
Out-of-bounds write in cdfs_open_cue_track in libretro libretro-common latest on all platforms allows remote attackers to execute arbitrary code via a crafted .cue file with a file path exceeding PATH_MAX_LENGTH that is...Show more
Out-of-bounds write in cdfs_open_cue_track in libretro libretro-common latest on all platforms allows remote attackers to execute arbitrary code via a crafted .cue file with a file path exceeding PATH_MAX_LENGTH that is copied using memcpy into a fixed-size buffer.Show less
CVE-2025-9136
1Libretro
1Retroarch
Sep 12, 2025
Aug 19, 2025
4.8 MEDIUM· v4
7.8 HIGH· v3
4.3 MEDIUM· v2
A flaw has been found in libretro RetroArch 1.18.0/1.19.0/1.20.0. This affects the function filestream_vscanf of the file libretro-common/streams/file_stream.c. This manipulation causes out-of-bounds read. The attack nee...Show more
A flaw has been found in libretro RetroArch 1.18.0/1.19.0/1.20.0. This affects the function filestream_vscanf of the file libretro-common/streams/file_stream.c. This manipulation causes out-of-bounds read. The attack needs to be launched locally. Upgrading to version 1.21.0 mitigates this issue. It is recommended to upgrade the affected component.Show less
CVE-2021-28927
1Libretro
1Retroarch
Nov 21, 2024
Apr 7, 2021
N/A· v4
7.8 HIGH· v3
4.6 MEDIUM· v2
The text-to-speech engine in libretro RetroArch for Windows 1.9.0 passes unsanitized input to PowerShell through platform_win32.c via the accessibility_speak_windows function, which allows attackers who have write access...Show more
The text-to-speech engine in libretro RetroArch for Windows 1.9.0 passes unsanitized input to PowerShell through platform_win32.c via the accessibility_speak_windows function, which allows attackers who have write access on filesystems that are used by RetroArch to execute code via command injection using specially a crafted file and directory names.Show less