CVE-2025-9809

Critical

Published: 01 September 2025

Published

01 September 2025

Modified

08 December 2025

KEV Added

—

Patch

—

CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0067 71.5th percentile

Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-9809 is a critical-severity Out-of-bounds Write (CWE-787) vulnerability in Libretro Libretro-Common. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked in the top 28.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploitation for Client Execution (T1203). What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match

prevent

Directly addresses the CVE by requiring identification, reporting, and correction of the out-of-bounds write flaw in libretro-common's cdfs_open_cue_track function via timely patching.

SI-10 Information Input Validation good match

prevent

Requires validation of file path lengths in crafted .cue files to prevent memcpy from writing beyond the fixed-size buffer.

SI-16 Memory Protection partial match

prevent

Implements memory protections such as non-executable stacks and address randomization to mitigate arbitrary code execution from the buffer overflow.

MITRE ATT&CK Enterprise TechniquesAI

T1203 Exploitation for Client Execution Execution

Adversaries may exploit software vulnerabilities in client applications to execute code.

attack.mitre.org →

Why these techniques?

Buffer overflow in libretro-common's .cue parser enables arbitrary code execution via crafted file, mapping to Exploitation for Client Execution (T1203).

NVD Description

Out-of-bounds write in cdfs_open_cue_track in libretro libretro-common latest on all platforms allows remote attackers to execute arbitrary code via a crafted .cue file with a file path exceeding PATH_MAX_LENGTH that is copied using memcpy into a fixed-size buffer.

Deeper analysisAI

CVE-2025-9809 is an out-of-bounds write vulnerability in the cdfs_open_cue_track function of the libretro-common library, affecting the latest version across all platforms. The issue arises when processing a crafted .cue file with a file path exceeding PATH_MAX_LENGTH, which is copied using memcpy into a fixed-size buffer, enabling remote attackers to execute arbitrary code. It carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and maps to CWE-787.

Remote, unauthenticated attackers can exploit this vulnerability with low complexity and no user interaction required. By delivering a malicious .cue file to a system using the affected libretro-common library, they can trigger the buffer overflow, achieving full arbitrary code execution with high confidentiality, integrity, and availability impacts.

The vulnerability is documented in the libretro-common GitHub repository, with the relevant code located at formats/cdfs/cdfs.c line 471 and an associated issue tracked at issues/222.