CVE-2025-64390: PlayStation 4 BD-J Sandbox Escape Privilege Escalation (Firmware 13.00-13.02)

Technical summary

CVE-2025-64390 is a privilege escalation vulnerability affecting the BD-J (Blu-ray Disc Java) sandbox implementation in PlayStation 4 firmware versions 13.00 through 13.02. The vulnerability stems from improper handling of malformed JAR files, which can be exploited to escape sandbox restrictions and execute code with elevated privileges. The underlying weakness is classified under CWE-367 (Time-of-check Time-of-use race condition), indicating a potential race condition or validation bypass in the JAR file processing logic. The vulnerability requires local access to the system (AV:L) and involves high complexity exploitation (AC:H), but does not require user interaction or special privileges to trigger. Once successfully exploited, an attacker achieves high-impact compromise of confidentiality, integrity, and availability.

Business impact

This vulnerability poses a direct risk to PlayStation 4 console owners and enterprises that manage PS4 deployments for media, entertainment, or development purposes. Exploitation could result in unauthorized access to user data stored on the console, modification of system settings or games, or complete control of the device. For organizations using PS4 systems in production environments, this represents a local privilege escalation vector that could be chained with other exploits or misconfigurations to expand attack scope. The vulnerability does not appear on the CISA Known Exploited Vulnerabilities (KEV) catalog as of the latest update, but the technical mechanics and local-access requirement mean exploitation is feasible within controlled environments.

Affected systems

PlayStation 4 consoles running firmware version 13.00, 13.01, or 13.02 are affected. Users running earlier firmware versions or those who have updated to version 13.03 or later are not vulnerable to this specific issue. The vulnerability is local-only and requires either physical console access or prior compromise of a user account on the system to deliver the malicious JAR file.

Exploitability

While this vulnerability carries a HIGH CVSS score of 7.4, exploitation requires local system access and is not remotely exploitable over the network. An attacker must either have physical access to the PS4 or already have authenticated access to deliver and execute a malformed JAR file. The high complexity factor (AC:H) suggests that successful exploitation requires specific conditions or precise timing, potentially making ad-hoc attacks more difficult. However, motivated attackers with local access—such as a console owner or someone with brief physical access—could potentially weaponize this vector. The absence of user interaction requirements (UI:N) means no social engineering is necessary once local access is achieved.

Remediation

Sony has addressed this vulnerability in PlayStation 4 firmware versions released after 13.02. The primary remediation is to update the PS4 system to the latest available firmware. Users should enable automatic system updates in their console settings to ensure they receive security patches promptly. For organizations managing multiple PS4 systems, firmware updates should be deployed through centralized management tools or manual updates on an expedited schedule. Until patched, restrict physical and logical access to affected consoles, particularly in multi-user or shared environments.

Patch guidance

Verify the current firmware version of your PlayStation 4 by navigating to System Software Update in the console's settings. Any version 13.03 or later addresses this vulnerability; versions 13.00 through 13.02 remain at risk. To update: connect the PS4 to the internet, access Settings > System Software Update, and follow the on-screen prompts. Ensure the console remains powered and connected throughout the update process. For organizations, confirm the deployment of patched firmware across all managed devices and maintain an inventory of PS4 systems to track patch compliance.

Detection guidance

Monitor PlayStation 4 console logs and system events for unusual BD-J or Blu-ray application activity, particularly failed or abnormal JAR file loads. Review access logs for unauthorized privilege escalation events or unexpected process executions with elevated privileges. Network-level detection is limited due to the local-only attack vector, but organizations should monitor for anomalous behavior on PS4 systems, such as unexpected outbound connections or file system modifications. Firmware version audits across managed devices will confirm exposure. Consider implementing endpoint detection and response (EDR) tools if available for gaming console management in your environment.

Why prioritize this

This vulnerability warrants prompt attention due to its HIGH severity rating and the complete privilege escalation impact it enables. Although local access is required, PlayStation 4 systems are often used in shared household or office environments where physical access may be possible. The vulnerability affects currently supported firmware versions, and the absence of widespread public exploit code should not reduce urgency—the technical mechanics are straightforward enough that exploitation could be demonstrated by capable attackers. Organizations should prioritize patching as part of routine security maintenance, and consumers should enable automatic updates to receive fixes proactively.

Risk score, explained

The CVSS 3.1 score of 7.4 (HIGH) reflects a vulnerability with significant impact but limited attack scope. The local attack vector (AV:L) prevents widespread remote exploitation, lowering the score relative to network-exploitable flaws. However, the absence of privilege requirements (PR:N) and user interaction (UI:N), combined with high complexity (AC:H) and complete impact on confidentiality, integrity, and availability (C:H/I:H/A:H), positions this as a serious local privilege escalation. The score appropriately captures the risk: a motivated attacker with local access can achieve complete system compromise, making this a priority for patch management and access control policies.

Frequently asked questions