CVE-2025-64390highCWE-367

CVE-2025-64390: high-severity vulnerability in Sony PS4

Published · Updated

Follow this CVE+ Monitor PS4

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.4epss 0.1%
In short

PlayStation 4 consoles running firmware versions 13.00 to 13.02 have a flaw where a specially crafted Blu-ray disc can break out of security restrictions and gain higher system privileges. This could allow someone to take control of the console or access protected data.

Technical detail

A privilege escalation vulnerability in PS4 BD-J sandbox (CWE-367: Time-of-check Time-of-use race condition) allows bypassing Blu-ray disc Java restrictions via malformed JAR files on affected firmware versions. Exploitation requires local access to play a crafted disc, resulting in elevated privileges and potential system compromise.

Summary generated and translated by AI from the official description.
A privilege escalation vulnerability exists in PlayStation 4 firmware versions 13.00 through 13.02. The BD-J (Blu-ray Disc Java) sandbox can be escaped through a malformed JAR file.
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Sony · PS4
Related CVEs — Sony PS4

In the same product, most dangerous first.

CVE-2022-3349MEDIUMSony PS4/PS5 exFAT UVFAT_readupcasetable heap-based overflowEPSS 0.6%