Robocode CVE-2025-14307

Requires an authenticated low-privileged local account on the same host (AV:L, PR:L) where Robocode 1.9.3.6 is executed, a shared or predictable temporary directory (e.g., a world-writable /tmp), and the ability to win a timing race against RecordManager's insecure File.createTempFile followed by delete()/createNewFile() sequence while a battle recording is being written. Limiting factors that reduce realistic risk: the attack is local-only (not remotely reachable), the victim must actively be running Robocode and saving/recording battles for the vulnerable code path to execute, and exploitation hinges on winning a non-deterministic race window rather than a deterministic trigger.

The headline CVSS 4.0 base score is 9.3 (Critical), but the vector itself tempers that: AV:L means this is a LOCAL attack, not network-reachable, and PR:L means the attacker must already hold a low-privileged local account on the host. The high score is driven by all three vulnerable-system impacts (VC/VI/VA:H) AND all three subsequent-system impacts (SC/SI/SA:H) being set to High, which appears inflated for a classic CWE-377 insecure-temp-file race in a hobby/educational application - such flaws typically yield localized file overwrite or same-privilege code execution rather than full subsequent-system compromise. The provided vector also uses AC:L, whereas race-condition exploitation realistically requires winning a non-deterministic timing window, which argues for higher attack complexity. No EPSS score, no CISA KEV listing, and no public exploit were provided, so there is no evidence of real-world exploitation. CONFLICT TO VERIFY: the description attributes the flaw to the 'AutoExtract component,' but the only source-code evidence (NVD-referenced PR #68) patches RecordManager.java (battle-recording temp files) - verify which component is actually affected with the vendor. Bottom line: this is a high-CVSS-but-low-real-risk issue for most environments because it is local-only, requires an existing authenticated account, depends on a race window, and the affected product is niche.

A low-privileged user already logged into a multi-user host where Robocode 1.9.3.6 is run pre-creates a symlink or predictable file in the shared temporary directory, then races the RecordManager's createTempFile/delete-and-recreate sequence while a battle recording is saved, redirecting the write to overwrite a file the victim process can modify or to inject attacker-controlled content. No public proof-of-concept was provided, and success depends on winning the timing race against the privileged file operation.