CVE-2025-14307 Insecure Temporary File Creation in Robocode's AutoExtract Component

What is CVE-2025-14307?

CVE-2025-14307 is a critical vulnerability in Robocode, published on 9 Dec 2025. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

An insecure temporary file creation vulnerability exists in the AutoExtract component of Robocode version 1.9.3.6. The createTempFile method fails to securely create temporary files, allowing attackers to exploit race conditions and potentially execute arbitrary code or overwrite critical files. This vulnerability can be exploited by manipulating the temporary file creation process, leading to potential unauthorized actions.

Weakness: CWE-377

Which versions are affected by CVE-2025-14307?

2 open source packages ship an affected version, including net.sf.robocode:robocode.battle. It affects 1 product.

Products include Robocode Robocode.

How do I fix CVE-2025-14307?

Upgrade net.sf.robocode:robocode.battle to 1.9.5.6 or later.

Is CVE-2025-14307 being exploited?

There is no known exploitation of CVE-2025-14307 in the wild and no public exploit code.

Other vulnerabilities in Robocode

• CVE-2025-14306 Directory Traversal in Robocode's CacheCleaner Component Critical 10.0
• CVE-2025-14308 Integer Overflow in Robocode's Buffer Write Method Critical 10.0
• CVE-2019-10648 Improper Input Validation in net.sf.robocode:robocode.host allows for external service interaction Critical 9.8
• CVE-2008-2078 Other in n/a High 7.5
• CVE-2007-6382 Robocode Arbitrary Code Execution Medium 6.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2025-14307, GHSA-2mxr-rc97-xrj2, UBUNTU-CVE-2025-14307.