CVE-2025-34449 is a critical bug (CVSS 9.1) in Genymobile scrcpy, the tool that mirrors and controls Android devices. Versions up to and including 3.3.3 mishandle a device message, so a compromised device can cause out of bounds reads on the host. The fix is commit 3e40b24.
What's affected
The record lists Genymobile scrcpy versions up to and including 3.3.3, prior to commit 3e40b24. The flaw is in the function sc_device_msg_deserialize(), which parses messages that the Android device sends back to the computer running scrcpy.
The upstream fix is a one line change to a bounds check in the message parsing code, with the commit message saying the check was incorrect. I could not confirm from the pages I read which release number first includes it. Check the scrcpy releases page and confirm that your version is newer than 3.3.3 and includes that commit.
How to check if you're exposed
Run the version command on every machine where scrcpy is installed:
scrcpy --version
If it prints 3.3.3 or lower, update. If you installed through a package manager, check whether your distribution has packaged a fixed build, since distributions often lag upstream. Package managers on Linux, Homebrew on macOS and Scoop on Windows each have their own query for the installed version.
The risk depends on the device. The record describes a compromised device sending crafted messages. If you only connect phones you own and trust, the exposure is lower than if you connect test devices, shared devices or devices from unknown sources.
What to do now
- List developer and test machines that have scrcpy installed.
- Update to a release newer than 3.3.3 that contains commit 3e40b24, or build from upstream source.
- Until updated, avoid mirroring untrusted or possibly compromised Android devices.
- Keep tooling versions in your software inventory so that the next advisory is a lookup, not a hunt.
- If scrcpy is bundled in another project or an internal image, update that copy too.
Why it matters
The record classifies the weakness as CWE-502, deserialization of untrusted data (CWE-502), although the description reads as a classic bounds checking bug in a parser. Whatever the label, the lesson is the same. A host application that parses bytes from a peer has to treat those bytes as hostile, even when the peer is a device the user plugged in.
The outcome in the record is out of bounds reads, which may mean memory corruption or a crash, and the record says it may allow further exploitation on the host. The record does not claim active exploitation, and it is not on the CISA Known Exploited Vulnerabilities list. Developer workstations are still valuable targets, because they hold source code and credentials.
The free in-browser dependency scan at gold.safeguard.sh/scan can help you find projects in your own repositories that vendor or depend on affected code.
Quick check
Which scrcpy versions are affected?
The record says versions up to and including 3.3.3, before commit 3e40b24.
Who can trigger it?
According to the record, a compromised device connected to scrcpy can send the crafted messages.
Sources
Last reviewed: 18 October 2026.
