CVE-2026-111152: Game Music Emu (libgme) through 0.6.5 Heap Out-of-Bounds Read via AY Loader
Game Music Emu (libgme) through 0.6.5 contains a heap out-of-bounds read vulnerability in the AY loader getdata function caused by an integer underflow in the track-table bounds check. Attackers can supply a crafted ZXAYEMUL file with an oversized track table to read past the file buffer via gmetrackinfo or gmestarttrack, crashing libgme consumers.
Affected Software
Event History
Frequently Asked Questions
Which application code paths should teams audit?
Audit libgme consumers that accept ZXAYEMUL files and call gme_track_info or gme_start_track. The issue affects the AY loader's track-table handling.
Does exploitation require privileges or user interaction?
The supplied vector indicates no privileges are required, but user interaction is required. Attackers need local access and a crafted ZXAYEMUL file to reach the vulnerable processing path.
What is the expected operational impact?
The reported impact is availability: reading past the file buffer can crash an application that uses the affected library.