libretro/RetroArch

libretro/RetroArch

www.libretro.com

Releases132

Frequency1 month 1 week

Last Release8 months ago

Stars13.4K

Cross-platform, sophisticated frontend for the libretro API. Licensed GPLv3.

Log in to subscribe

CVE History

CVE	Affected	Published	CVSS v3	CVSS v2
CVE-2025-9136NVD↗	= 1.18.0, = 1.19.0, = 1.20.0	Aug 19, 2025Tuesday, 19 August 2025, 12:15	5.3 MEDIUM	4.3 MEDIUM
A flaw has been found in libretro RetroArch 1.18.0/1.19.0/1.20.0. This affects the function filestream_vscanf of the file libretro-common/streams/file_stream.c. This manipulation causes out-of-bounds read. The attack needs to be launched locally. Upgrading to version 1.21.0 mitigates this issue. It is recommended to upgrade the affected component.
CVE-2021-28927NVD↗	>= 1.9.0, <= 1.9.4	Apr 7, 2021Wednesday, 7 April 2021, 15:15	7.8 HIGH	4.6 MEDIUM
The text-to-speech engine in libretro RetroArch for Windows 1.9.0 passes unsanitized input to PowerShell through platform_win32.c via the accessibility_speak_windows function, which allows attackers who have write access on filesystems that are used by RetroArch to execute code via command injection using specially a crafted file and directory names.