High severity7.8NVD Advisory· Published Apr 7, 2021· Updated Jul 9, 2026

CVE-2021-28927

Description

The text-to-speech engine in libretro RetroArch for Windows 1.9.0 passes unsanitized input to PowerShell through platform_win32.c via the accessibility_speak_windows function, which allows attackers who have write access on filesystems that are used by RetroArch to execute code via command injection using specially a crafted file and directory names.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Libretro/Retroarch2 versions
cpe:2.3:a:libretro:retroarch:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:libretro:retroarch:*:*:*:*:*:*:*:*range: >=1.9.0,<=1.9.4
- (no CPE)range: = 1.9.0
libretro/RetroArchdescription
RetroArch/RetroArchllm-create
Range: = 1.9.0

Patches

Vulnerability mechanics

References

github.com/libretro/RetroArch/blob/d3dc3ee989ec6a4903c689907ffc47027f71f776/frontend/drivers/platform_win32.cnvdPatchThird Party Advisory
labs.bishopfox.com/advisories/retroarch-for-windows-version-1.9.0nvdExploitThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.507
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000