Scrcpy
Monthly
A compromised or malicious Android device connected over USB/ADB can crash the scrcpy host client (versions up to and including 3.3.3, prior to commit 3e40b24) by sending crafted device messages that trigger out-of-bounds reads in sc_device_msg_deserialize(). Publicly available exploit code exists, but with an EPSS score of only 0.42% (34th percentile) and no CISA KEV listing, multiple signals point to a modest, situationally-bounded risk rather than a top-tier priority; per the assessed CVSS 3.1 vector the impact is availability only (client crash or denial of service) with no confirmed confidentiality or integrity loss, though the advisory notes this may enable further exploitation on the host system.
A compromised or malicious Android device connected over USB/ADB can crash the scrcpy host client (versions up to and including 3.3.3, prior to commit 3e40b24) by sending crafted device messages that trigger out-of-bounds reads in sc_device_msg_deserialize(). Publicly available exploit code exists, but with an EPSS score of only 0.42% (34th percentile) and no CISA KEV listing, multiple signals point to a modest, situationally-bounded risk rather than a top-tier priority; per the assessed CVSS 3.1 vector the impact is availability only (client crash or denial of service) with no confirmed confidentiality or integrity loss, though the advisory notes this may enable further exploitation on the host system.