Vita3K CVE-2026-112049

Exploitation requires the victim to install a crafted .vpk archive through Vita3K's package installation feature (the install_archive_content() code path); the attacker must get this malicious archive onto the victim's machine and convince them to install it. The specific prerequisite is a .vpk whose zip entry names embed '..' traversal segments or absolute paths. Limiting factors: this is local-only (AV:L) with required active user interaction (UI:A) - there is no remote or network trigger - so it depends entirely on social engineering or a poisoned package source; it affects Vita3K builds before 4187 and is fully remediated in patched builds. Write destinations are limited to locations writable by the Vita3K process.

This is a medium-severity (CVSS 6.7, CVSS:4.0 base) local file-write flaw whose real-world risk is moderate-to-low for most environments but non-trivial for the hobbyist community that runs Vita3K. The CVSS 4.0 vector is internally consistent with the description: AV:L (the attacker does not reach this over the network - a local user must install a package), AT:N and AC:L (no special timing/conditions once a crafted archive is processed), PR:N (no Vita3K authentication exists), and crucially UI:A (active user interaction - the victim must choose to install a malicious .vpk). Impact is scoped to integrity (VI:H) with VC:N/VA:N, reflecting arbitrary file write rather than guaranteed confidentiality or availability loss; the 'potentially enabling host code execution' phrasing is a plausible chained outcome, not a demonstrated one, which is why the vendor did not score confidentiality/availability. No EPSS score, no CISA KEV entry, and no SSVC decision data were supplied in the input, and no public exploit is referenced - so there is no public exploit identified at time of analysis. The combination of required user interaction, local-only vector, and a niche product means this is NOT a mass-exploitation priority; it is best treated as a supply-chain/social-engineering risk within the emulation ecosystem. A patch is confirmed available (vendor commit 55f88cd), so remediation is straightforward.

An attacker packages a malicious .vpk (e.g., disguised as a homebrew app or game) whose zip entries contain '..' segments or absolute paths, and distributes it on an emulation forum or file-sharing site. A victim installs it in Vita3K, and install_archive_content() writes the attacker-controlled files outside the intended install directory - for example into a startup or executable location - potentially leading to host code execution. No public exploit code is identified at time of analysis.