PlayStation 4 Firmware CVE-2025-64390

Exploitation requires the attacker to deliver a specifically malformed JAR via a Blu-ray Disc Java (BD-J) title to a PS4 console running firmware in the 13.00-13.02 range and for the BD-J runtime to load and execute that JAR - i.e., the user (or attacker with physical access) must insert and launch the malicious disc. Limiting factors include the local attack vector (AV:L, physical media required, no remote network path), high attack complexity (AC:H) reflecting the TOCTOU race window that must be won reliably, and the narrow firmware version band; consoles on firmware below 13.00 or already updated past 13.02 are out of scope. No authentication to the console is required (PR:N) and no user interaction beyond inserting the disc (UI:N).

The CVSS 7.4 reflects a high-impact local escape (C:H/I:H/A:H) gated by AC:H race-condition timing and AV:L physical media delivery, which is consistent with the SSVC assessment of Exploitation: none and Automatable: no, but Technical Impact: total. EPSS at 0.02% (5th percentile) and the absence of CISA KEV listing align with SSVC's 'no observed exploitation' signal, suggesting this is currently a theoretical or research-grade issue rather than an opportunistic target. The realistic threat population is jailbreakers and homebrew researchers rather than mass attackers, because exploitation requires authoring a malicious Blu-ray disc and physically inserting it into the targeted console. No conflicting signals were observed in the provided data; the only gap is that no PoC link was supplied beyond the HackerOne disclosure report.

A researcher or attacker authors a Blu-ray disc containing a malformed JAR designed to win a TOCTOU race inside the BD-J runtime; when the disc is inserted into a PS4 running firmware 13.00-13.02 and its BD-J title autoloads, the race lets attacker-controlled bytecode escape the Java sandbox and run with elevated privileges on the console. No public exploit identified at time of analysis, though the HackerOne report indicates a working proof-of-concept was demonstrated to Sony during disclosure.