Integer Overflow in Robocode's Buffer Write Method
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-190 and the CVSS impact.
Summary
An integer overflow vulnerability exists in the write method of the Buffer class in Robocode version 1.9.3.6. The method fails to properly validate the length of data being written, allowing attackers to cause an overflow, potentially leading to buffer overflows and arbitrary code execution. This vulnerability can be exploited by submitting specially crafted inputs that manipulate the data length, leading to potential unauthorized code execution.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Robocode Project | Robocode | 1.9.3.6 | — | No fix listed | CNA |
- Robocode VendorRobocode Project Affected 1.9.3.6 Fixed in — No fix listed CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:robocode:robocode:1.9.3.6:*:*:*:*:*:*:* | 1.9.3.6 | Vulnerable | Robocode Project |
- cpe:2.3:a:robocode:robocode:1.9.3.6:*:*:*:*:*:*:* Versions 1.9.3.6 Vulnerable ·Robocode Project
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2025-14308
- 2026-10-03 Alias added: GHSA-jqf9-28w7-q25g
References
More Robocode Project Robocode vulnerabilities
- TI-2025-13069 Directory Traversal in Robocode's CacheCleaner Component CVSS 4.0CRITICAL 10.0
- TI-2019-07943 Robocode through 1.9.3.5 allows remote attackers to cause external service interaction… CVSS 3.0CRITICAL 9.8
- TI-2025-13070 Insecure Temporary File Creation in Robocode's AutoExtract Component CVSS 4.0CRITICAL 9.3
- TI-2008-01998 Robocode before 1.6.0 allows user-assisted remote attackers to "access the internals of… CVSS 2.0HIGH 7.5
- TI-2007-06088 The Event Dispatch Thread in Robocode before 1.5.1 allows remote attackers to execute… CVSS 2.0MEDIUM 6.8
Sources
- CVE-2025-14308 · CVE Program
- CVE-2025-14308 · NVD
- FIRST EPSS
- GHSA-jqf9-28w7-q25g · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences