Bug 2390335 (CVE-2025-29366)

Summary: CVE-2025-29366 mupen64plus: array overflow in the write_rdram_regs and write_rdram_regs functions
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedKeywords: Security
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
An array overflow vulnerability has been discovered in Mupen64Plus, where out-of-bounds writes can overwrite function pointers in the host machine’s memory. This flaw enables a maliciously crafted input to escape the virtualized environment and achieve arbitrary command execution on the host system.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2393063, 2393064    
Bug Blocks:    

Description OSIDB Bzimport 2025-08-22 16:02:17 UTC 
In mupen64plus v2.6.0 there is an array overflow vulnerability in the write_rdram_regs and write_rdram_regs functions, which enables executing arbitrary commands on the host machine.