CVE-2025-49589: PCSX2 Contains a Stack-based Buffer Overflow in IOP Console Logging

Severity: medium (CVSS 6.1 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-06-12 · updated 2026-06-17
Weakness: CWE-121

Description

PCSX2 is a free and open-source PlayStation 2 (PS2) emulator. A stack-based buffer overflow exists in the Kprintf_HLE function of PCSX2 versions up to 2.3.414. Opening a disc image that logs a specially crafted message may allow a remote attacker to execute arbitrary code if the user enabled IOP Console Logging. This vulnerability is fixed in 2.3.414.

Affected products

pcsx2: before 2.3.414

References

https://github.com/PCSX2/pcsx2/pull/12823
https://github.com/PCSX2/pcsx2/pull/12826
https://github.com/PCSX2/pcsx2/security/advisories/GHSA-f494-4xf7-xj35

Get alerted when CVE-2025-49589 or the next vulnerability affects your stack