CVE-2025-14308: Critical Integer Overflow in Robocode

CVE-2025-14308 is a critical severity (CVSS 9.8) integer overflow in the write method of the Buffer class in Robocode 1.9.3.6. The method does not validate the data length, which can lead to buffer overflows and possibly code execution. A fix pull request is linked. Confirm which release contains it, then update.

What's affected

• Product: Robocode, the Java programming game.
• Affected version: 1.9.3.6, per the record.
• Component: the write method of the Buffer class.
• Fix: the record links a pull request. We did not confirm which published release includes it, so check the release notes.
• Weakness: CWE-190 (integer overflow or wraparound). See the Gold page for CVE-2025-14308.
• Severity: Critical, CVSS 9.8, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
• CISA KEV: not listed.

How to check if you're exposed

Find the Robocode version in the About dialog or in the file name of the jar or installer. Version 1.9.3.6 is the affected release in the record.

If a build pulls Robocode in as a library, search your build files for it and generate a resolved dependency list. A scan of the manifest in the free in-browser dependency scan shows whether the version you resolve is the one in the record.

Next ask whether any untrusted data can reach the buffer writing code. The record does not detail the entry points, so read the pull request to see which code paths feed data into it.

What to do now

1. Inventory every Robocode install and every project that depends on it.
2. Read the linked pull request and the release notes, then update to a release that includes the change.
3. Do not run battles from untrusted networks or load untrusted robots on machines that matter until you have updated.
4. Run Robocode as an unprivileged user, not as an administrator.
5. Rescan your dependencies after the update to confirm the new version resolves.
6. If you cannot update, remove Robocode from shared or internet facing machines.

Why it matters

An integer overflow occurs when arithmetic on a length wraps around to a small number. A size check that passes on the wrapped value, followed by a write using the real value, can write past the end of a buffer. In memory safe languages the failure is usually an exception, but record data describes buffer overflow and code execution as possible outcomes.

The record rates every impact as high and the vector shows network reach with no privileges and no user interaction, hence 9.8. The real world risk depends on how Robocode is deployed. It is not in CISA KEV and the record does not state exploitation. Use the fix and the checks above rather than the score alone to decide urgency.

Quick check

Sources

• NVD record data for CVE-2025-14308 (Safeguard Gold entry)
• Public report

Last reviewed: 19 October 2026.