CVE-2026-116727: gbsplay through 0.0.103 Heap Out-of-Bounds Read via vgm_open in gbs.c
gbsplay through 0.0.103 contains a heap out-of-bounds read vulnerability in vgmopen() in gbs.c that walks the VGM command stream without bounds checks. Attackers can supply a crafted VGM file with wait opcodes and no 0x66 terminator to read past the heap buffer and crash the player.
Affected Software
Event History
Frequently Asked Questions
What must an attacker provide to trigger the issue?
The attacker must supply a crafted VGM file containing wait opcodes and lacking a 0x66 terminator. Processing that file can cause vgm_open() to read beyond the heap buffer and crash the player.
Is remote exploitation indicated by the available severity data?
No. The supplied vector lists local attack access and user interaction, indicating that a user must interact with the crafted file rather than the issue being directly network-reachable.
What is the expected impact?
The described impact is a player crash caused by a heap out-of-bounds read. The supplied vector indicates availability impact only, with no confidentiality or integrity impact.