RetroArch v1.22.2 contains an execution flow flaw that allows an attacker to force the program to load code that the attacker specifies. When another user session follows this instruction, the attacker’s code runs with the victim’s effective UID. This grants the attacker arbitrary code execution on the system with the privileges of the victim user. The vulnerability arises from insufficient validation of code paths supplied by the user and is tantamount to CWE‑94.

The affected product is RetroArch, a multi‑platform emulator frontend. The flaw applies to version 1.22.2 and, by implication, to any earlier release that has not been patched. No other vendors or products are listed as affected.

The CVSS score is not provided, and the EPSS score is unavailable, but arbitrary code execution maps to a high‑severity rating. The vulnerability is not listed in CISA’s KEV catalog, yet the impact remains significant. Attackers would need to provoke or coerce another user session capable of initiating a load action; the precise conditions for exploitation are not detailed in the data. While no public exploit is reported, the potential for a high‑impact attack is evident.