CVE-2025-9809
Published: 01 September 2025
Summary
CVE-2025-9809 is a high-severity Out-of-bounds Write (CWE-787) vulnerability in Libretro Libretro-Common. Its CVSS base score is 8.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked in the top 25.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-9809 is an out-of-bounds write vulnerability in the cdfs_open_cue_track function of the libretro-common library, affecting the latest version across all platforms. The issue arises when processing a crafted .cue file with a file path exceeding PATH_MAX_LENGTH, which is copied using memcpy into a fixed-size buffer, enabling remote attackers to execute arbitrary code. It carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and maps to CWE-787.
Remote, unauthenticated attackers can exploit this vulnerability with low complexity and no user interaction required. By delivering a malicious .cue file to a system using the affected libretro-common library, they can trigger the buffer overflow, achieving full arbitrary code execution with high confidentiality, integrity, and availability impacts.
The vulnerability is documented in the libretro-common GitHub repository, with the relevant code located at formats/cdfs/cdfs.c line 471 and an associated issue tracked at issues/222.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-26355
Vulnerability details
Out-of-bounds write in cdfs_open_cue_track in libretro libretro-common latest on all platforms allows remote attackers to execute arbitrary code via a crafted .cue file with a file path exceeding PATH_MAX_LENGTH that is copied using memcpy into a fixed-size buffer.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in libretro-common's .cue parser enables arbitrary code execution via crafted file, mapping to Exploitation for Client Execution (T1203).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly addresses the CVE by requiring identification, reporting, and correction of the out-of-bounds write flaw in libretro-common's cdfs_open_cue_track function via timely patching.
Requires validation of file path lengths in crafted .cue files to prevent memcpy from writing beyond the fixed-size buffer.
Implements memory protections such as non-executable stacks and address randomization to mitigate arbitrary code execution from the buffer overflow.