Vulnerability · Published Jun 12, 2025 · Assigned by GitHub_M

CVE-2025-49589PCSX2 Contains a Stack-based Buffer Overflow in IOP Console Logging

Medium 6.1

In plain English

A medium-severity stack buffer overflow in pcsx2 from PCSX2. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)6.1Medium

Exploit odds (30 days)0.3%top 76.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

PCSX2 is a free and open-source PlayStation 2 (PS2) emulator. A stack-based buffer overflow exists in the Kprintf_HLE function of PCSX2 versions up to 2.3.414. Opening a disc image that logs a specially crafted message may allow a remote attacker to execute arbitrary code if the user enabled IOP Console Logging. This vulnerability is fixed in 2.3.414.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	pcsx2	no fix listed	DEBIAN-CVE-2025-49589
Debian:13	pcsx2	1.6.0+dfsg-3+deb13u1	DEBIAN-CVE-2025-49589
Debian:14	pcsx2	2.4.0+dfsg-1	DEBIAN-CVE-2025-49589
Ubuntu:22.04:LTS	pcsx2	no fix listed	UBUNTU-CVE-2025-49589
Ubuntu:24.04:LTS	pcsx2	no fix listed	UBUNTU-CVE-2025-49589
Ubuntu:25.10	pcsx2	no fix listed	UBUNTU-CVE-2025-49589
Ubuntu:26.04:LTS	pcsx2	no fix listed	UBUNTU-CVE-2025-49589
Ubuntu:26.10	pcsx2	no fix listed	UBUNTU-CVE-2025-49589

Affected products (as reported)

Vendor	Product	Versions
PCSX2	pcsx2	< 2.3.414

Weakness: CWE-121 · Vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:N/VI:H/VA:H/SC:H/SI:H/SA:H

References

https://github.com/PCSX2/pcsx2/security/advisories/GHSA-f494-4xf7-xj35 x_refsource_CONFIRM
https://github.com/PCSX2/pcsx2/pull/12823 x_refsource_MISC
https://github.com/PCSX2/pcsx2/pull/12826 x_refsource_MISC