Robocode CVE-2025-14308

Exploitation requires the victim to import and execute an attacker-supplied Robocode robot, which then calls the vulnerable RobotFileOutputStream.write(byte[], off, len) with a crafted length/offset that defeats the missing/incorrect bounds validation (the pre-patch code only checked len<0). Limiting factors: this is a local desktop Java application, not a network service, so an attacker must deliver and get the malicious robot run (user interaction); the code path is the robot sandbox's file-write facility, so the practical impact is a sandbox file-write/bounds bypass and likely an exception-driven crash rather than confirmed native code execution. The input CVSS AV:N/PR:N/UI:N does not reflect these constraints and should be verified with the vendor.

The input assigns a maximal CVSS 4.0 score of 10.0 (AV:N/AC:L/PR:N/UI:N with High confidentiality, integrity, and availability impact on both vulnerable and subsequent systems), which on paper signals a critical remotely-exploitable flaw. However, these signals conflict sharply with the actual nature of the product and the patch evidence. Robocode is a desktop Java programming game in which users write and run 'robot' code; the vulnerable method is RobotFileOutputStream.write in the host's sandbox file I/O layer, meaning realistic exploitation requires an attacker to get a victim to load and run a malicious robot locally - not a true network-reachable, zero-interaction attack as AV:N/UI:N implies. There is no EPSS score, no CISA KEV listing (no public exploit identified at time of analysis), and no public POC supplied; the only reference is the GitHub pull request containing the fix. Furthermore, the CWE-190 integer-overflow-to-arbitrary-code-execution claim is questionable in a managed Java runtime, where an out-of-bounds array write raises an exception rather than corrupting memory, so the practical outcome is more likely a sandbox file-write bypass or denial of service than reliable native code execution. Net assessment: this is a high-CVSS-but-low-real-world-risk issue - a niche hobby/educational product, no evidence of exploitation, and a vector score that materially overstates reachability. CVSS indicates a network vector but the affected component implies local, robot-load-dependent access - verify AV and the ACE claim with the vendor.

An attacker publishes or shares a specially crafted Robocode robot that, when imported and run by a victim, invokes the Buffer/RobotFileOutputStream write method with manipulated offset/length values to trigger the integer overflow and bypass the intended bounds check. No public exploit identified at time of analysis; exploitation depends on the victim choosing to load and execute the untrusted robot, so it is local and interaction-dependent rather than remote and automatic (contradicting the input AC:L/UI:N).