CVE-2025-34449 MEDIUM

CVE-2025-34449: Genymobile/scrcpy <= 3.3.3 Global Buffer Overflow

Vendor Genymobile
Product scrcpy
Weakness CWE-502 · Unsafe deserialization
Published December 18, 2025
Last update March 23, 2026

CVSS base score

6.9/10
Attack vector Local
Attack complexity Low
Privileges required None
User interaction None
Confidentiality
Integrity

CVSS vector

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

What the vulnerability does

01Description

Genymobile/scrcpy versions up to and including 3.3.3, prior to commit 3e40b24, contain a buffer overflow vulnerability in the sc_device_msg_deserialize() function. A compromised device can send crafted messages that cause out-of-bounds reads, which may result in memory corruption or a denial-of-service condition. This vulnerability may allow further exploitation on the host system.

Key dates

02Disclosure timeline

December 18, 2025 CVE published
March 23, 2026 Record updated