CVE-2025-67749 Overview
CVE-2025-67749 is an out-of-bounds read vulnerability in PCSX2, the free and open-source PlayStation 2 emulator. The flaw exists in versions 2.5.377 and earlier. Unchecked offset and size values used in a memcpy operation inside the CDVD SCMD 0x91 and SCMD 0x8F handlers allow a specially crafted disc image or ELF binary to trigger the read. Because the offset and size are controlled through MG header fields, a crafted ELF can read data beyond the bounds of mg_buffer and reflect that data back into emulated memory. The issue is fixed in version 2.5.378 and is tracked under [CWE-125].
Critical Impact
A crafted disc image or ELF loaded by PCSX2 can leak adjacent host memory contents into emulated PS2 memory, exposing sensitive process data to guest code.
Affected Products
- PCSX2 versions 2.5.377 and below
- CDVD SCMD 0x91 handler
- CDVD SCMD 0x8F handler
Discovery Timeline
- 2025-12-12 - CVE-2025-67749 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-67749
Vulnerability Analysis
The vulnerability resides in PCSX2's emulation of the CDVD subsystem, specifically the sub-command handlers SCMD 0x91 and SCMD 0x8F. These handlers process MG (Magic Gate) headers used for PS2 disc authentication and copy protection routines. When the handler receives an MG header, it calls memcpy using an offset and size parsed directly from the header without validating them against the bounds of the source buffer, mg_buffer. An attacker who supplies a crafted disc image or ELF binary controls both fields. The result is an out-of-bounds read that copies data adjacent to mg_buffer in the emulator process's address space. That data is then written into emulated PS2 memory, where guest code executing in the emulator can inspect and exfiltrate it.
Root Cause
The root cause is missing input validation on attacker-controlled length and offset values before a memory copy operation. The MG header fields are trusted without sanity checks against the actual size of mg_buffer, violating the principle of validating all externally sourced data used as buffer indices or copy lengths [CWE-125].
Attack Vector
Exploitation requires a user to load a malicious disc image or ELF file in PCSX2. The attack vector is classified as network with user interaction because the file can be delivered through common distribution channels such as game archives, ROM sites, or peer-to-peer sharing. Once loaded, the ELF issues the vulnerable CDVD sub-command with crafted MG header values. Technical implementation details are documented in the GitHub Security Advisory GHSA-69wg-97fx-8j5w and the fix commit.
Detection Methods for CVE-2025-67749
Indicators of Compromise
- Unexpected ELF files or disc images loaded by PCSX2 from untrusted sources.
- PCSX2 process exhibiting abnormal memory access patterns near the mg_buffer region.
- Guest PS2 code issuing repeated CDVD SCMD 0x91 or SCMD 0x8F calls with unusual MG header field values.
Detection Strategies
- Inventory endpoints running PCSX2 and flag any instance reporting a version at or below 2.5.377.
- Monitor for downloads of ISO, BIN, or ELF files from untrusted repositories on hosts that also run PCSX2.
- Apply file integrity monitoring to the PCSX2 installation directory to detect unauthorized binary replacement.
Monitoring Recommendations
- Enable application telemetry to track PCSX2 launches and the file paths of loaded disc images or ELFs.
- Alert on PCSX2 processes that trigger memory access violations or unusual read patterns from adjacent heap regions.
- Correlate PCSX2 usage with security awareness training records to identify high-risk hosts.
How to Mitigate CVE-2025-67749
Immediate Actions Required
- Upgrade PCSX2 to version 2.5.378 or later on all systems where the emulator is installed.
- Verify the installed version by checking the application's About dialog or the executable's version metadata.
- Restrict PCSX2 to loading disc images and ELF files only from trusted, verified sources.
Patch Information
The maintainers released the fix in PCSX2 v2.5.378. The corrective change adds bounds validation on the offset and size fields parsed from the MG header before the memcpy in the CDVD SCMD 0x91 and SCMD 0x8F handlers. Full details are available in the commit diff.
Workarounds
- Do not open PS2 disc images or ELF files obtained from untrusted sources until the emulator is patched.
- Run PCSX2 inside a sandbox or virtual machine with no access to sensitive host data.
- Uninstall PCSX2 on systems where it is not required for business or personal use.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
