Azahar 2126.2 fixes arbitrary code execution flaw in CIA file handling

The Azahar Nintendo 3DS emulator has released version 2126.2, a security-focused update for its stable branch. The release patches GHSA-h74v-5mw8-qg8r, a vulnerability in CIA file installation that allowed arbitrary host code execution. Additional fixes include Vulkan renderer texture filtering corrections, improved large download handling for eShop content, Android crash fixes, and breaking changes to the desktop RPC server that require script developer updates.

What's fixed in Azahar 2126.2

• Security (CVE-equivalent): GHSA-h74v-5mw8-qg8r — specially-crafted CIA files could execute arbitrary code in the host environment during local installation
• Rendering: xBRZ texture filter now applies correctly under Vulkan renderer
• Networking: Large HTTP downloads in emulated 3DS apps use memory more efficiently; fixes eShop large game downloads
• Plugin system: New allow_homebrew_load 3GX loader flag enables homebrew plugin loading when supported
• Desktop tooling: GDB and RPC servers received multiple fixes; breaking change requires RPC client updates by script developers
• Android: Crash fixed when gpu_drivers directory contains subdirectories
• Kernel accuracy: svcMapProcessMemoryEx now supports copying kernel shared and config pages

Why it matters

The arbitrary code execution vulnerability in CIA handling is a serious security issue for users who install homebrew or dumped game content, making prompt updates essential. The breaking RPC change affects script developers and automation tooling built around Azahar's desktop interface.