CVE-2026-111153: Game Music Emu (libgme) through 0.6.5 Out-of-Bounds Read via Classic_Emu::mute_voices_
Game Music Emu (libgme) through 0.6.5 contains a global out-of-bounds read vulnerability in ClassicEmu::mutevoices that allows attackers to crash applications by supplying NSF files whose voice count exceeds the 16-entry voice-type table. Attackers can craft an NSF header with chipflags 0x3F, opened through gmeopendata or gmeopenfile, to read past the static array during loading and cause denial of service.
Affected Software
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications using libgme through 0.6.5 are exposed when they open attacker-controlled NSF content through gme_open_data or gme_open_file. The reported impact is an application crash during loading.
What must an attacker provide to trigger the crash?
The attacker needs to supply a crafted NSF file. Its header can set chip_flags to 0x3F, causing the NSF voice count to exceed the 16-entry voice-type table used by Classic_Emu::mute_voices_.
Is user interaction required?
Yes. The affected application must be induced to open the crafted NSF file or data stream. The vulnerability does not require attacker privileges in the application.
What can be done if updating libgme is not immediately possible?
Avoid opening NSF files from untrusted sources, or isolate the component that processes such files so a crash does not disrupt the main application. In particular, reject or otherwise avoid NSF inputs with chip_flags set to 0x3F.