Deserialization Flaw in Tencent MimicMotion Allows Remote Code Execution
CVE-2025-13716

7.8HIGH

Key Information:

Vendor

Tencent

Status
Mimicmotion
Vendor
CVE Published:
23 December 2025

What is CVE-2025-13716?

A vulnerability exists in Tencent MimicMotion's create_pipeline function, which improperly validates user-supplied data. This flaw allows remote attackers to execute arbitrary code on compromised installations when the user interacts with a malicious page or file. By exploiting this vulnerability, an attacker can gain root-level access, risking system integrity and confidentiality.

Affected Version(s)

MimicMotion Current

References

https://www.zerodayinitiative.com/advisories/ZDI-25-1032/
x_research-advisory
https://github.com/Tencent/MimicMotion/commit/6907bdcc259...
vendor-advisory

CVSS V3.0

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.
CVE-2025-13716 : Deserialization Flaw in Tencent MimicMotion Allows Remote Code Execution