CVE-2025-29366: 
Linux Debian vulnerability analysis and mitigation

In mupen64plus version 2.6.0, an array overflow vulnerability was discovered in the write_rdram_regs functions, which enables executing arbitrary commands on the host machine. The vulnerability was identified in August 2025 and affects the core component of the mupen64plus emulator (NVD, Debian Tracker).

The vulnerability is classified as CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) with a CVSS v3.1 base score of 9.8 CRITICAL (Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The issue stems from multiple security weaknesses including array overflow in write_rdram_regs functions, out-of-bounds memory access, and potential null pointer dereference (NVD, GitHub PR 1080).

The vulnerability allows attackers to execute arbitrary commands on the host machine through the emulator, effectively enabling a virtual machine escape. This poses a significant security risk as it could lead to complete system compromise with the ability to achieve arbitrary code execution on the host system (NVD).

Several security patches have been developed and are pending merge into the main codebase. These include fixes for register mirroring (PR #1119), DMA operation bounds checking (PR #1122), and integer overflow protection (PR #1123). OpenBSD has already backported these security patches in their ports tree (OpenBSD Ports).