CVE-2018-25109 json
Nintendo Animal Crossing Letter Trigram ac-exploit-gc memory corruption
published 2025-03-23 19 mo ago modified 2026-06-17 4 mo ago also EUVD-2018-21598
- cvss
- 6.4
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.2%
- EPSS 0.2% chance of exploitation in 30 days, percentile 11%
- public exploits
- 0
- none known
Summary
A vulnerability has been found in Nintendo Animal Crossing, Doubutsu no Mori+ and Doubutsu no Mori e+ 1.00/1.01 on GameCube and classified as critical. Affected by this vulnerability is an unknown functionality of the component Letter Trigram Handler. The manipulation leads to memory corruption. It is possible to launch the attack on the physical device. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used.
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- total
- Assessed
- 19 mo ago
Exploit prediction
0.21% chance of exploitation in the next 30 days, higher than 11% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- github.com https://github.com/FIX94/ac-exploit-gc referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 5.4 | CVSS:4.0/AV:P/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
| CNA | 3.1 | 6.4 | CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
| CNA | 3.0 | 6.4 | CVSS:3.0/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
| CNA | 2.0 | 6.2 | AV:L/AC:H/Au:N/C:C/I:C/A:C |
| CNA | 4.0 | 5.4 | CVSS:4.0/AV:P/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected products
- Nintendo Animal Crossing
- Nintendo Doubutsu no Mori+
- Nintendo Doubutsu no Mori e+
Classification
- Weakness
-
- CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
References
-
github.com
/FIX94/ac-exploit-gc
exploit
-
vuldb.com
/?id.300631
vdb-entry
-
vuldb.com
/?ctiid.300631
signature, permissions-required
-
jamchamb.net
/2018/07/11/animal-crossing-nes-emulator-hacks.html
related
-
hunter-r.com
/posts/ac-trigrams/
related
Sources
- CVE List CVE-2018-25109
- NVD CVE-2018-25109
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.