scrcpy CVE-2025-34449

No tagged release version is identified in the available data, so this is an upstream fix available (commit 3e40b24); rebuild the host client from commit 3e40b24 or later, or upgrade to the first tagged scrcpy release that includes it, then verify the corrected bounds check in app/src/device_msg.c is present. Because the fix is code-level and committed rather than published as a versioned advisory, treat any locally packaged or distro build of scrcpy 3.3.3 or earlier as vulnerable until the maintainer's commit is confirmed included (see https://github.com/Genymobile/scrcpy/commit/3e40b24 and https://github.com/Genymobile/scrcpy/issues/6415). Compensating controls, with trade-offs: only mirror devices you physically control and trust, which removes the attack precondition entirely but defeats the common use case of debugging borrowed, refurbished, or untrusted hardware; run scrcpy inside a container, VM, or dedicated low-privilege OS account to contain the 'further exploitation on the host system' risk the advisory raises, at the cost of losing direct ADB device passthrough and convenience; avoid enabling ADB over TCP or connecting untrusted devices to a workstation that also holds sensitive credentials; and monitor for repeated or unexplained scrcpy client crashes on hosts that mirror external devices, treating them as a potential indicator rather than routine instability. There is no configuration flag that disables the affected deserialization path while retaining device mirroring, so patching or rebuilding remains the only complete fix.