CVE-2026-116725: gbsplay through 0.0.103 Out-of-Bounds Read via mapper_map ROM Bank Index
gbsplay through 0.0.103 contains an out-of-bounds read vulnerability in mappermap() in mapper.c that fails to reject ROM bank indexes beyond the ROM size, causing an underflowed bank length. Attackers can supply crafted .gbr, .gbs or .gb files with malicious bank indexes to make bankget() read far past the heap ROM buffer and crash the player.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users of gbsplay through 0.0.103 are exposed when they open or play an attacker-controlled .gbr, .gbs, or .gb file. The issue requires local access to the player rather than network reachability.
What does exploitation require and what is the impact?
An attacker needs to provide a crafted file containing malicious ROM bank indexes and induce a user to process it with gbsplay. The described impact is an out-of-bounds read past the heap ROM buffer that can crash the player, resulting in denial of service.
Are default installations affected?
The available information identifies affected versions through 0.0.103 but does not describe any configuration prerequisite. Processing a malicious supported file is the relevant exposure condition.
What can be done before an update is available?
Do not open or play untrusted .gbr, .gbs, or .gb files with affected gbsplay versions. Restrict use to files from trusted sources until the referenced fix can be applied.