CVE-2026-116726: gbsplay through 0.0.103 Heap Out-of-Bounds Read via gbr_open GBR Title
Gbsplay through 0.0.103 contains a heap out-of-bounds read vulnerability in gbropen() in gbs.c that fails to verify file length before scanning the GBR ROM title field. Attackers can supply a crafted GBR file of 0x21 to 0x162 bytes to read past the heap buffer, crashing gbsplay or leaking memory.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users or systems that open attacker-supplied GBR files with gbsplay through version 0.0.103 are exposed. Exploitation requires local access to the application and user interaction to open or process the crafted file.
What does an attacker need to provide?
The attacker needs to supply a malformed GBR file between 0x21 and 0x162 bytes in length. The flaw is triggered while gbsplay scans the GBR ROM title field without first verifying that the file is long enough.
What is the practical impact?
A crafted file can cause gbsplay to read beyond its heap buffer, which may crash the application or disclose memory contents. The provided severity vector indicates no confidentiality or integrity impact and a low availability impact.
How can I tell whether I may be affected?
Check whether your installed gbsplay version is 0.0.103 or earlier and whether it processes GBR files from untrusted sources. Review logs or crash reports for failures occurring while opening GBR files, particularly unusually short files.