Skip to content
Heist/ feed
Back to feed
Medium

gbsplay through 0.0.103 Heap Out-of-Bounds Read via vgm_open in gbs.c

Type: advisorySources: Official CVE List

gbsplay through 0.0.103 contains a heap out-of-bounds read vulnerability in vgm_open() in gbs.c that walks the VGM command stream without bounds checks. Attackers can supply a crafted VGM file with wait opcodes and no 0x66 terminator to read past the heap buffer and crash the player.

Products
gbsplay
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2026-116727
Confirmed fixed CVEs
Not specified
Updated in this feed
31 Oct 2026, 00:32 UTC · Revision 1

Source evidence

gbsplay through 0.0.103 Heap Out-of-Bounds Read via vgm_open in gbs.c

core-cve · Original source

Published 26 Oct 2026, 21:52 UTC

gbsplay through 0.0.103 contains a heap out-of-bounds read vulnerability in vgm_open() in gbs.c that walks the VGM command stream without bounds checks. Attackers can supply a crafted VGM file with wait opcodes and no 0x66 terminator to read past the heap buffer and crash the player.

cve:CVE-2026-116727

gbsplay

Fixed versions: Not specified

Complete source record
{
  "id": "f18f24c845f20115cb5db7cd55da89b0e83018d8c1be794f87c26e782f225f2d",
  "url": "https://www.cve.org/CVERecord?id=CVE-2026-116727",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "gbsplay through 0.0.103 Heap Out-of-Bounds Read via vgm_open in gbs.c",
    "summary": "gbsplay through 0.0.103 contains a heap out-of-bounds read vulnerability in vgm_open() in gbs.c that walks the VGM command stream without bounds checks. Attackers can supply a crafted VGM file with wait opcodes and no 0x66 terminator to read past the heap buffer and crash the player.",
    "evidence": "cve:CVE-2026-116727",
    "products": [
      {
        "name": {
          "value": "gbsplay",
          "evidence": "/containers/cna/affected/0/product"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": []
      }
    ],
    "severity": "medium",
    "structured": {
      "id": "CVE-2026-116727",
      "aliases": [
        "CVE-2026-116727"
      ],
      "metrics": [
        {
          "format": "CVSS",
          "cvssV4_0": {
            "version": "4.0",
            "baseScore": 4.8,
            "attackVector": "LOCAL",
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
            "userInteraction": "PASSIVE",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "privilegesRequired": "NONE",
            "subIntegrityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "subAvailabilityImpact": "NONE",
            "vulnAvailabilityImpact": "LOW",
            "subConfidentialityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE"
          }
        },
        {
          "format": "CVSS",
          "cvssV3_1": {
            "scope": "UNCHANGED",
            "version": "3.1",
            "baseScore": 3.3,
            "attackVector": "LOCAL",
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
            "integrityImpact": "NONE",
            "userInteraction": "REQUIRED",
            "attackComplexity": "LOW",
            "availabilityImpact": "LOW",
            "privilegesRequired": "NONE",
            "confidentialityImpact": "NONE"
          }
        }
      ],
      "affected": [
        {
          "repo": "https://github.com/mmitch/gbsplay",
          "vendor": "mmitch",
          "product": "gbsplay",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "custom",
              "lessThanOrEqual": "0.0.103"
            }
          ],
          "packageURL": "pkg:github/mmitch/gbsplay",
          "defaultStatus": "unaffected"
        }
      ],
      "modified": "2026-10-26T21:52:30.198Z",
      "provider": "cve",
      "references": [
        "https://github.com/mmitch/gbsplay/issues/201",
        "https://github.com/mmitch/gbsplay",
        "https://github.com/mmitch/gbsplay/commit/91b1f6df0abd3914f91caa528ec3213d731999e8",
        "https://github.com/mmitch/gbsplay/blob/0.0.103/gbs.c#L996-L1010",
        "https://hackmd.io/@haindpwn/gbsplay-rom-bank-index-oob-read",
        "https://www.vulncheck.com/advisories/gbsplay-through-0.0.103-heap-out-of-bounds-read-via-vgm-open-in-gbs-c"
      ],
      "provider_metadata": {
        "cna": {
          "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
          "shortName": "VulnCheck",
          "dateUpdated": "2026-10-26T21:52:30.198Z"
        }
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-116727",
        "evidence": "/cveMetadata/cveId"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/containers/cna/metrics"
  },
  "source_id": "core-cve",
  "document_id": 353929,
  "published_at": "2026-10-26T21:52:30.198+00:00"
}