CVE-2025-67749: 
Linux Debian vulnerability analysis and mitigation

CVE-2025-67749 is an out-of-bounds read vulnerability in PCSX2, a free and open-source PlayStation 2 emulator, affecting versions 2.5.377 and below. The flaw exists in the CDVD SCMD 0x91 and SCMD 0x8F handlers, where an unchecked offset and size are passed to memcpy operations, allowing a specially crafted disc image or ELF file to read data beyond the bounds of mg_buffer and reflect it back into emulated memory. The vulnerability was disclosed on December 12, 2025, and fixed in version 2.5.378 (GitHub Advisory). It carries a CVSS v4.0 base score of 5.3 (Medium) (Feedly).

The root cause is an out-of-bounds read (CWE-125) in pcsx2/CDVD/CDVD.cpp, where the mg_BIToffset() return value and derived sizes are used directly in memcpy/memmove calls without validating that the offset and computed copy length remain within the bounds of cdvd.mg_buffer. In SCMD 0x91, the bit_ofs value controls reads into mg_kbit and mg_kcon arrays; in SCMD 0x8F, an attacker-controlled block count field (mg_buffer[bit_ofs + 4]) determines the copy_len for a memmove back to the start of mg_buffer. A specially crafted ELF or disc image with malicious MG header fields can trigger these handlers, causing the emulator to read and expose memory contents beyond the intended buffer (GitHub Advisory, Fix Commit). The fix adds explicit bounds checks before each memcpy/memmove operation, aborting with fail_pol_cal() if the offset or computed length would exceed the buffer (Fix Commit).

Successful exploitation allows an attacker to leak contents of the PCSX2 emulator process memory beyond the intended mg_buffer boundary, which could expose sensitive in-process data such as cryptographic keys or other emulator state. The vulnerability also has a limited availability impact, as malformed inputs could cause unexpected emulator behavior. Because exploitation requires a user to load a crafted disc image or ELF file, the attack surface is limited to users who run untrusted software within PCSX2; there is no direct path to host OS compromise or lateral movement (GitHub Advisory, Feedly).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2025-67749. The EPSS score is approximately 0.04%, indicating a very low probability of exploitation in the near term (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires user interaction — specifically, a victim must load a specially crafted disc image or ELF file in a vulnerable version of PCSX2 (GitHub Advisory).

1. Craft a malicious ELF or disc image: Create a PS2 ELF or disc image with a specially crafted MG header where the bit_ofs value (returned by mg_BIToffset()) and the block count field (mg_buffer[bit_ofs + 4]) are set to values that, when used in memcpy/memmove, cause reads beyond the end of cdvd.mg_buffer.
2. Distribute the crafted file: Deliver the malicious ELF or disc image to a target user, for example via a file-sharing site, forum, or direct transfer, relying on the user to load it in PCSX2.
3. Trigger the vulnerable SCMD handler: When the victim loads and runs the crafted file in PCSX2 ≤ 2.5.377, the emulator processes the MG header through the CDVD SCMD 0x91 or SCMD 0x8F handler, triggering the unchecked memcpy with the attacker-controlled offset and size.
4. Leak emulator memory: Out-of-bounds data from the PCSX2 process memory is read and reflected back into emulated PS2 memory, potentially exposing sensitive emulator state that could be observed through the emulated environment (GitHub Advisory, Fix Commit).

Users should upgrade PCSX2 to version 2.5.378 or later, which includes the fix for this vulnerability (PCSX2 Release). The patch adds bounds checks on bit_ofs and the computed copy length before any memcpy/memmove in the affected SCMD handlers (Fix Commit). As a workaround for users unable to upgrade immediately, the official advisory recommends not running untrusted homebrew or ELF software in PCSX2 (GitHub Advisory).

The vulnerability was discovered by security researcher slashbinslashcat and remediated by PCSX2 developer F0bes, who published the GitHub Security Advisory on December 12, 2025 (GitHub Advisory). The issue received routine coverage from vulnerability tracking services including Tenable Nessus (plugin 278622), Red Hat CVE database, and ENISA's EUVD, but no significant broader media or community discussion has been identified (Feedly).