What’s Vulnerable › Vulnerabilities

CVE-2025-34449: Genymobile/scrcpy <= 3.3.3 Global Buffer Overflow

• Severity: critical (CVSS 9.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-12-18 · updated 2026-09-30
• Weakness: CWE-502

Description

Genymobile/scrcpy versions up to and including 3.3.3, prior to commit 3e40b24, contain a buffer overflow vulnerability in the sc_device_msg_deserialize() function. A compromised device can send crafted messages that cause out-of-bounds reads, which may result in memory corruption or a denial-of-service condition. This vulnerability may allow further exploitation on the host system.

Affected products

• Genymobile scrcpy: before 3.3.4 — fixed in 3.3.4

How to fix

Upgrade to a fixed version: Genymobile scrcpy 3.3.4. Check the vendor advisory for mitigations.

References

• https://github.com/Genymobile/scrcpy/commit/3e40b24
• https://github.com/Genymobile/scrcpy/issues/6415
• https://github.com/marlinkcyber/advisories/blob/main/advisories/MCSAID-2025-003-scrcpy-global-buffer-overflow.md
• https://www.vulncheck.com/advisories/genymobile-scrcpy-global-buffer-overflow
• https://github.com/marlinkcyber/advisories/blob/main/advisories/MCSAID-2025-003-scrcpy-global-buffer-overflow.md

Get alerted when CVE-2025-34449 or the next vulnerability affects your stack