Back Linuxsecurity

Fedora 42: Fix for Critical 7

Linuxsecurity •LinuxSecurity Advisories • December 25, 2025

libretro is an API that exposes generic audio/video/input callbacks. A frontend for libretro (such as RetroArch) handles video output, audio output, input and application lifecycle. A libretro core written in portable C or C++ can run seamlessly on many platforms with very little to no porting effort. While RetroArch is the reference frontend for libretro, several other projects have used the libretro interface to include support for emulators and/or game engines. libretro is completely open and free for anyone to use. For how to download and install more libretro cores please read included README.fedora.md file. Update Information : Update to 1.22.0

libretro is an API that exposes generic audio/video/input callbacks. A frontend

for libretro (such as RetroArch) handles video output, audio output, input and

application lifecycle. A libretro core written in portable C or C++ can run

seamlessly on many platforms with very little to no porting effort.

While RetroArch is the reference frontend for libretro, several other projects

have used the libretro interface to include support for emulators and/or game

engines. libretro is completely open and free for anyone to use.

For how to download and install more libretro cores please read included

README.fedora.md file.

* Thu Dec 18 2025 Artem Polishchuk - 1.22.0-1 - Update to 1.22.0 * Thu Nov 6 2025 Dominik 'Rathann' Mierzejewski - 1.19.0-15 - Fixed build with FFmpeg 8 * Wed Oct 15 2025 Dominik 'Rathann' Mierzejewski - 1.19.0-14 - Rebuilt for FFmpeg 8 * Fri Jul 25 2025 Fedora Release Engineering - 1.19.0-13 - Rebuilt for * Tue May 27 2025 Jitka Plesnikova - 1.19.0-12 - Rebuilt for flac 1.5.0

[ 1 ] Bug #2290413 - retroarch-1.22.2 is available [ 2 ] Bug #2381834 - CVE-2025-53817 retroarch: 7-Zip Null pointer array write [fedora-42] [ 3 ] Bug #2381837 - CVE-2025-53816 retroarch: 7-Zip heap buffer overflow [fedora-42] [ 4 ] Bug #2387650 - CVE-2025-55188 retroarch: 7-Zip Symbolic Link Extraction Vulnerability [fedora-42] [ 5 ] Bug #2389431 - CVE-2025-9136 retroarch: libretro RetroArch file_stream.c filestream_vscanf out-of-bounds [fedora-42] [ 6 ] Bug #2415383 - Broken AppStream metadata [ 7 ] Bug #2418241 - CVE-2025-11001 retroarch: 7-Zip ZIP File Parsing Directory Traversal Remote Code Executio... Read the Full Advisory

This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2025-dda924d757' at the command line. For more information, refer to the dnf documentation available at

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Buffer Overflow Issue in RetroArch Affecting Fedora 43 A critical buffer overflow vulnerability has been identified in RetroArch, a frontend for the libretro API, affecting users of Fedora 43. The issue allows potential exploitation due to improper handling of audio/video/input callbacks, posing risks to system integrity. Users are advised to apply patches as they become available to mitigate this vulnerability. 2 sources 34

Extracted Entities

CVEs (5)

CVE-2025-11001 CVE-2025-53816 CVE-2025-53817 CVE-2025-55188 CVE-2025-9136

Domains (1)

readme.fedora.md