Find a vulnerability

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "game-music-emu VGM Command",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "advisories"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "----------------------------------------------------------------------------\nNotCVE Advisory \u2014 NotCVE-2026-0016\n----------------------------------------------------------------------------\n\n[-] Summary:\nAn out-of-bounds read in the VGM command interpreter of game-music-emu\n(libgme), the open-source video game music emulation library, allows an\nattacker who supplies a crafted .vgm or .vgz file to crash the hosting\nprocess or to have adjacent heap memory influence the rendered audio, via\na PCM seek command whose offset is never validated. CVSS:3.1 7.1\n(AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H).\n\n[-] Affected:\ngame-music-emu (libgme) through 0.6.5, and master as of commit fe8da4b.\nDefault builds; no fixed version is verified.\n\n[-] Technical Description:\nVgm_Emu_Impl::run_commands() in gme/Vgm_Emu_Impl.cpp handles VGM command\n0xE0 (cmd_pcm_seek) by building an interior pointer straight from file\ncontent:\n\n  case cmd_pcm_seek:\n      pcm_pos = pcm_data + pos [3] * 0x1000000L + pos [2] * 0x10000L +\n              pos [1] * 0x100L + pos [0];\n      pos += 4;\n      break;\n\npcm_data points into the decompressed file buffer, set by a preceding 0x67\n(cmd_data_block) command. The 32-bit little-endian operand is\nattacker-controlled and is compared neither against the declared\ndata-block size nor against data_end, so pcm_pos can be placed up to 4 GiB\npast the end of the allocation. The following 0x80-0x8F (cmd_pcm_delay)\ncase then executes write_pcm( vgm_time, *pcm_pos++ ), dereferencing the\npointer without a bounds check of its own. The reporter\u0027s AddressSanitizer\nlog records a SEGV on a read at Vgm_Emu_Impl.cpp:255 in run_commands().\n\nWhen the computed address is unmapped the read faults and the process\nterminates; when it is mapped, the byte read becomes part of the decoded\naudio, so memory adjacent to the file buffer can influence\nattacker-observable output.\n\nReachability: the VGM emulator is part of the default build, and the\ncommand stream runs during gme_start_track(), on the file-open path. VLC\u0027s\nmodules/demux/gme.c calls gme_start_track() from its demuxer Open\nfunction, and FFmpeg links the library when built with --enable-libgme. No\nauthentication, privileges or configuration change are needed; the file\nonly has to reach a libgme consumer.\n\nUpstream issue #165 reports a related but different overread in the same\nfunction (unchecked command argument bytes); it is not this defect.\n\nWeaknesses:\nCWE-823: Use of Out-of-range Pointer Offset\nCWE-125: Out-of-bounds Read\nCAPEC-540: Overread Buffers\nCAPEC-129: Pointer Manipulation\n\n[-] Credit:\nDiscovered by netspacer1124 (https://github.com/netspacer1124).\n\n[-] Full Details and Updates:\nhttps://notcve.org/notcve/NotCVE-2026-0016\n\n[-] Main References:\nhttps://github.com/libgme/game-music-emu\nhttps://raw.githubusercontent.com/libgme/game-music-emu/0.6.5/gme/Vgm_Emu_Impl.cpp\nhttps://github.com/videolan/vlc/blob/master/modules/demux/gme.c\n\n[-] About NotCVE:\nNotCVE (https://notcve.org) assigns public, timestamped NotCVE IDs to\nvulnerabilities not acknowledged by vendors. Vendor will not assign a CVE?\nRequest a NotCVE: https://notcve.org/form/ \u00b7 Contributors:\nhttps://notcve.org/hall/\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "CWE-125",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-823",
              "description": "CWE-823",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-02T04:57:33Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/92"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Sep/92"
        },
        {
          "url": "https://github.com/libgme/game-music-emu"
        },
        {
          "url": "https://github.com/netspacer1124"
        },
        {
          "url": "https://github.com/videolan/vlc/blob/master/modules/demux/gme.c"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://notcve.org"
        },
        {
          "url": "https://notcve.org/form/"
        },
        {
          "url": "https://notcve.org/hall/"
        },
        {
          "url": "https://notcve.org/notcve/NotCVE-2026-0016"
        },
        {
          "url": "https://raw.githubusercontent.com/libgme/game-music-emu/0.6.5/gme/Vgm_Emu_Impl.cpp"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Sep/92"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[NotCVE-2026-0016] game-music-emu VGM Command Interpreter Unvalidated 0xE0 PCM Seek Offset Allows Out-of-Bounds Read and Denial of Service",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0420",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/92",
            "automated": true,
            "contentSha256": "fb1c944970260cb0d7b8467a8c1a9c2d3bbaec1f2d89a79624890ae0dd35bd4a",
            "evidenceScore": 8,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/92",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-09-29T08:25:18Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-10-02T04:57:33Z",
    "dateUpdated": "2026-10-02T04:57:33Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0420"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}