Gbsplay through 0.0.103 contains a heap out-of-bounds read vulnerability in gbropen() in gbs.c that fails to verify file length before scanning the GBR ROM title field. Attackers can supply a crafted GBR file of 0x21 to 0x162 bytes to read past the heap buffer, crashing gbsplay or leaking memory.

gbsplay through 0.0.103 contains an out-of-bounds read vulnerability in mappermap() in mapper.c that fails to reject ROM bank indexes beyond the ROM size, causing an underflowed bank length. Attackers can supply crafted .gbr, .gbs or .gb files with malicious bank indexes to make bankget() read far past the heap ROM buffer and crash the player.