Only the latest release branch (master) receives security fixes.
If you discover a security vulnerability in RPCS4, please report it responsibly:
- Do not open a public issue.
- Send a report to the maintainers via Discord or by emailing a maintainer directly.
- Include as much detail as possible: steps to reproduce, affected versions, and potential impact.
- Allow the maintainers reasonable time to respond and coordinate a fix.
RPCS4 is an emulator that runs user-provided game binaries. The following are not considered security vulnerabilities:
- Crashes or undefined behavior caused by malformed PS4 executables (these are emulation bugs)
- Performance issues or resource exhaustion from emulated code
- Issues in third-party dependencies (report them to their respective projects)
We do take seriously any vulnerabilities that could affect the host system, such as:
- Buffer overflows in host-side code paths (loader, linker, HLE libraries)
- Path traversal in filesystem emulation
- Arbitrary code execution on the host
- Denial of service via malicious input files (PKG, firmware images)
- We aim to acknowledge reports within 7 days.
- We will coordinate a fix timeline with the reporter.
- The fix will be included in the next release.
- Public disclosure will occur after the fix is merged or after 90 days, whichever comes first.