vue-after-free: a PlayStation Vue userland exploit wrapped in a TypeScript app

What the exploit actually is

Vue After Free is a PlayStation Vue userland code execution exploit for PlayStation 4, and it is worth being precise about the parts.

The vulnerability itself is CVE-2017-7117, used for the userland. There was an earlier CVE-2018-4441, which was applied shortly after, but due to instability and a bad success rate it was dropped. So the repository ships one userland exploit and chains it with kernel exploits: Lapse and Poopsploit, which is also called Netctrl, on the respective firmwares.

The scope table separates the three components:

| vue-after-free (Userland) | Lapse (KEX) | Netctrl (KEX) | | :------------------------ | :---------- | :--------------- | | 5.05-13.04 | 1.01-12.02 | 1.01-13.00 |

And the table of what the current version of the repository actually provides is narrower, because a working jailbreak needs the whole chain:

| 7.00-13.00 | | :--------- |

The reason is spelled out. By default Lapse is used from 7.00 to 12.02, and Poopsploit from 12.50 to 13.00, although you can choose to run Poopsploit on as low as 9.00. The userland exploit works from 5.05 to 13.04 as is, meaning the userland piece alone covers a much wider range, but the combined jailbreak is what the repository supports and the FAQ is explicit that above 13.00 you get only the userland and cannot jailbreak with the files in the repository.

The project is GPL-3.0 licensed, the primary language is TypeScript, the last push was on 2026-06-01, and the releases are 2.0 from 2026-02-25, v1.4 from 2026-02-12 and v1.3 from 2026-02-10. The authors also run a Discord for support.

Three install routes, and what each one costs you

The introduction explains that the exploit can be run a number of ways, and the three routes differ in what they require and what they destroy.

The manual method is for a console that is already jailbroken. If you can already jailbreak and want to try Vue, use the manual method. If you are already jailbroken and just want to update the exploit files, there is an update.js for that.

Extended storage and save resign is for a non-jailbroken console. It needs an internet connection on the PS4, a fake or legitimate activated PSN user account, a 256GB or larger USB, HDD or SSD with any larger drive also working, and a way to resign a save file, which can be a jailbroken PS4, a Discord bot or Save Wizard. The save file that installs the exploit data is the one you resign.

The system backup method is the other non-jailbroken route, and it is the destructive one. It needs a network connection, a USB flash drive and a system backup file, and the warning is unambiguous: restoring the system backup will erase all data on your console, then apply the Vue app and its exploit data to it.

The Lite version exists for people who want to skip the themed interface. The full app has a fun UI with cats and theme support to tinker with, alongside a payload menu and auto run options, and the Lite version is for anyone who just wants to jailbreak and load the payload from the USB, and it works with any of the three methods.

The documentation asks you to create backups of the savedata relevant to running the exploit and of your own from games, and the important note at the end of the requirements says the Vue save file may occasionally reset, so copy the encrypted save to a USB from the PS4 settings menu for the user that runs the jailbreak, for easy future recovery. There is also a warning not to change the np environment via Debug Settings, since it makes you unable to use a backup save file and is incompatible with the current fake sign in payload.

The failure modes, and the recovery paths

The FAQ section is the most useful part of the repository for anyone who has already tried this, because it is written entirely around what goes wrong.

The first question is whether it works on 13.02 or above, and the answer is that only the userland does, since you cannot jailbreak above 13.00 with the files in the repository.

The second is about the network. The console needs any form of network connection, not specifically internet. You can use a mobile phone hotspot or anything else available, and Vue will not launch the exploit without a network connection and will display There was a problem connecting to the internet.

The third is the error that scares people, There is a network communication issue, which indicates that either Vue has updated or your save file has reset. The recovery paths are several. You can use your own profile backup's save, or if you are using the system backup from the repository, unpack the encryptedsavebackup.zip to a USB and import it with the PS4 saved data management. If all the internal data is gone you can use the OnlineSave that is signed to VueUser to enable the jailbreak again, or resign it to your account, and it is recommended to keep a copy signed to your main user or a spare user.

The related error, This service requires you to sign in to PlayStation Network even after replacing the save file, means the Vue app most likely updated, and this usually happens when not using a DNS or blocking Sony servers, in which case you have to delete and reinstall the app, and the extended storage method is the way to do that.

Two more are hardware-level. If the app crashed, the exploit failed, so shut down the console and try again. If the console shut down, a kernel panic may have occurred and you may need to press the power button twice, then retry.

And there is a note that the Vue save file may occasionally reset, which is the reason for the copy to USB instruction in the requirements section.

Running payloads, and the USB format

The payload workflow has a rule that is easy to get wrong.

Closing and reopening Vue is required between running JavaScript payloads, but .bin or .elf payloads can be run one after the other, and you select the payload from the UI in the Payload Menu.

So the two payload families behave differently. A JavaScript payload needs a fresh application launch, which is the part that makes a sequence of JS payloads tedious, while a .bin or .elf payload does not.

The other rule is about the USB drive. If your payload is not recognized, format the USB drive to MBR partition and exFAT format. That is a specific requirement and a common failure, since a drive formatted as NTFS or GPT is not what the console expects.

The requirement for the USB in the non-jailbroken extended storage route is that it be 256GB or above, with any drive larger than 256GB also working, which is a strange constraint that reflects how the console mounts the media rather than any real need for that much space.

The console also needs a network connection to launch the app in every route, and the FAQ is clear that this does not have to be the internet. You can use home WiFi, a hotspot from your mobile phone, a network from a microcontroller like an ESP32, or an Ethernet network from a repurposed PPPwn device.

The codebase, and the tooling behind the build

The repository is mostly a front end for the exploit, and the build tooling reflects that.

The package manifest is a TypeScript project with babel doing the compilation, and the build script compiles the.ts sources into dist, then creates a download0/img directory and copies three image folders into it, text, susec and feil. The name of the output directory is dictated by the console, not by taste.

The linting is eslint over.ts and.js files, with a separate fix target. The dev dependencies are the babel cli and presets, the eslint packages, typescript-eslint, and TypeScript itself as a peer dependency. The runtime dependencies are jiti, which is a TypeScript runtime loader, and neostandard.

Alongside the JavaScript there is a Python side, and the requirements file is short and specific: cryptography at 46.0.3, websockets at 15.0.1 and pyreadline3 at 3.5.4. The cryptography and websockets pair points at the save file signing and the console side channel, and pyreadline3 is the Windows line editing library, which suggests a script that runs on a Windows machine to talk to the console over FTP.

The repository layout is src/ for the TypeScript source, types/ for the type declarations, tools/ for the helper scripts, and module-remover/ for stripping parts of the payload. The babel.config.json, eslint.config.ts, tsconfig.json and a.prettierrc at the root are the usual set for a TypeScript project with formatting pinned.

The licences deserve a note. The project is GPL-3.0.

Editorial conclusion

vue-after-free fits a PS4 owner on a supported firmware who wants homebrew and has the network connectivity, a signed save file and a USB drive to work with, and who is willing to read the recovery documentation before touching the console. It is a poor fit for anyone whose console holds data they cannot lose, since one of the install routes erases it by design, and a poor fit above firmware 13.00 for anything beyond the userland component. Before you run it, back up your own saves as the documentation insists, and if you already have a working jailbreak, use the manual method and the update script rather than a system backup.

Frequently asked questions

Official sources

1. Issues
2. License: GPL-3.0
3. README
4. Releases
5. Vuemony/vue-after-free on GitHub