UBUNTU-CVE-2026-116727: Medium severity ubuntu/gbsplay vulnerability
gbsplay through 0.0.103 contains a heap out-of-bounds read vulnerability in vgmopen() in gbs.c that walks the VGM command stream without bounds checks. Attackers can supply a crafted VGM file with wait opcodes and no 0x66 terminator to read past the heap buffer and crash the player.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems running gbsplay through version 0.0.103 are exposed when a user opens or plays an attacker-supplied VGM file. The attack requires local access and user interaction.
What does an attacker need to provide?
An attacker needs to craft a VGM file containing wait opcodes without a 0x66 terminator. Processing that file can cause vgm_open() in gbs.c to read beyond the heap buffer and crash the player.
What is the likely impact?
The reported impact is a denial of service through a player crash caused by a heap out-of-bounds read. The provided severity vector indicates no stated confidentiality or integrity impact.