CVE-2025-34449
CriticalSummary
Buffer overflow vulnerability in sc_device_msg_deserialize() in Genymobile/scrcpy up to version 3.3.3. A compromised device can send crafted messages causing out-of-bounds reads, potentially leading to memory corruption or denial of service.
Risk Assessment
The vulnerability may allow further exploitation on the host system, including code execution or instability.
Recommendation
Update scrcpy to a patched version (commit 3e40b24) and avoid connecting untrusted devices.
Original NVD description (English source)
Genymobile/scrcpy versions up to and including 3.3.3, prior to commit 3e40b24, contain a buffer overflow vulnerability in the sc_device_msg_deserialize() function. A compromised device can send crafted messages that cause out-of-bounds reads, which may result in memory corruption or a denial-of-service condition. This vulnerability may allow further exploitation on the host system.