Search
Find a vulnerability
Search criteria
2 vulnerabilities found for game-music-emu libgme by unknown
GCVE-1988-2026-0422
Vulnerability from gna-1988 – Published: 2026-10-02 04:57 – Updated: 2026-10-02 04:57
VLAI
EPSS
VEX
Title
[NotCVE-2026-0018] game-music-emu (libgme) through 0.6.5 Unbounded GYM Command Loop Allows Heap Out-of-Bounds Read
Summary
----------------------------------------------------------------------------
NotCVE Advisory — NotCVE-2026-0018
----------------------------------------------------------------------------
[-] Summary:
An out-of-bounds read in the GYM playback path of game-music-emu (libgme),
the open-source video game music emulation library, allows an attacker who
supplies a crafted .gym file to read heap memory past the end of the
allocation holding the file contents, potentially terminating the process.
CVSS:3.1 5.4 (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L).
[-] Affected:
game-music-emu (libgme) through 0.6.5 (present since at least 0.5.5), and
master as of commit fe8da4b. No fixed version is verified: upstream issue
#166, opened on 13 July 2026, describes the parse_frame defect and has had
no maintainer response.
[-] Technical Description:
The command loop of Gym_Emu::parse_frame() in gme/Gym_Emu.cpp is
while ( (cmd = *pos++) != 0 )
and terminates only on a 0x00 byte, with no bound against data_end.
Operands are then read unconditionally after the opcode: int data = *pos++
and, for a YM2612 port-0 register write (cmd == 1), a second
int data2 = *pos++. A file whose final frame ends mid-command therefore
reads 1 to 2 bytes past the end of the buffer. The if ( pos >= data_end )
check only runs after the loop has already walked off the end.
A second, broader unbounded scan exists in run_dac(), which looks ahead
with while ( (cmd = *p++) != 0 ) and no data_end bound at all. When the
final frame contains a DAC write (YM2612 register 0x2A on port 0) and no
0x00 follows before the end of the allocation, it can walk arbitrarily far
past the buffer, stopping on whatever zero byte adjacent heap memory
supplies. This second path is confirmed by reading the source at master
and 0.6.5, but is not exercised by the supplied proof-of-concept files.
Reachability: both paths run from gme_start_track() as soon as playback
begins (Music_Emu::start_track() -> ... -> Gym_Emu::play_frame() ->
parse_frame()). The file only needs the 428-byte GYMX header for
gme_identify_header() to route it to Gym_Emu. FFmpeg's
libavformat/libgme.c and VLC's modules/demux/gme.c both hand
attacker-supplied bytes to this path. The metadata (track length) path is
not affected.
Weaknesses:
CWE-125: Out-of-bounds Read
CWE-126: Buffer Over-read
CAPEC-540: Overread Buffers
[-] Credit:
Discovered by netspacer1124 (https://github.com/netspacer1124).
[-] Full Details and Updates:
https://notcve.org/notcve/NotCVE-2026-0018
[-] Main References:
https://github.com/libgme/game-music-emu/issues/166
https://raw.githubusercontent.com/libgme/game-music-emu/0.6.5/gme/Gym_Emu.cpp
https://github.com/libgme/game-music-emu
[-] About NotCVE:
NotCVE (https://notcve.org) assigns public, timestamped NotCVE IDs to
vulnerabilities not acknowledged by vendors. Vendor will not assign a CVE?
Request a NotCVE: https://notcve.org/form/ · Contributors:
https://notcve.org/hall/
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
12 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| unknown | game-music-emu libgme |
Affected:
unknown
|
{
"containers": {
"cna": {
"affected": [
{
"product": "game-music-emu libgme",
"vendor": "unknown",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "advisories"
}
],
"descriptions": [
{
"lang": "en",
"value": "----------------------------------------------------------------------------\nNotCVE Advisory \u2014 NotCVE-2026-0018\n----------------------------------------------------------------------------\n\n[-] Summary:\nAn out-of-bounds read in the GYM playback path of game-music-emu (libgme),\nthe open-source video game music emulation library, allows an attacker who\nsupplies a crafted .gym file to read heap memory past the end of the\nallocation holding the file contents, potentially terminating the process.\nCVSS:3.1 5.4 (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L).\n\n[-] Affected:\ngame-music-emu (libgme) through 0.6.5 (present since at least 0.5.5), and\nmaster as of commit fe8da4b. No fixed version is verified: upstream issue\n#166, opened on 13 July 2026, describes the parse_frame defect and has had\nno maintainer response.\n\n[-] Technical Description:\nThe command loop of Gym_Emu::parse_frame() in gme/Gym_Emu.cpp is\n\n while ( (cmd = *pos++) != 0 )\n\nand terminates only on a 0x00 byte, with no bound against data_end.\nOperands are then read unconditionally after the opcode: int data = *pos++\nand, for a YM2612 port-0 register write (cmd == 1), a second\nint data2 = *pos++. A file whose final frame ends mid-command therefore\nreads 1 to 2 bytes past the end of the buffer. The if ( pos \u003e= data_end )\ncheck only runs after the loop has already walked off the end.\n\nA second, broader unbounded scan exists in run_dac(), which looks ahead\nwith while ( (cmd = *p++) != 0 ) and no data_end bound at all. When the\nfinal frame contains a DAC write (YM2612 register 0x2A on port 0) and no\n0x00 follows before the end of the allocation, it can walk arbitrarily far\npast the buffer, stopping on whatever zero byte adjacent heap memory\nsupplies. This second path is confirmed by reading the source at master\nand 0.6.5, but is not exercised by the supplied proof-of-concept files.\n\nReachability: both paths run from gme_start_track() as soon as playback\nbegins (Music_Emu::start_track() -\u003e ... -\u003e Gym_Emu::play_frame() -\u003e\nparse_frame()). The file only needs the 428-byte GYMX header for\ngme_identify_header() to route it to Gym_Emu. FFmpeg\u0027s\nlibavformat/libgme.c and VLC\u0027s modules/demux/gme.c both hand\nattacker-supplied bytes to this path. The metadata (track length) path is\nnot affected.\n\nWeaknesses:\nCWE-125: Out-of-bounds Read\nCWE-126: Buffer Over-read\nCAPEC-540: Overread Buffers\n\n[-] Credit:\nDiscovered by netspacer1124 (https://github.com/netspacer1124).\n\n[-] Full Details and Updates:\nhttps://notcve.org/notcve/NotCVE-2026-0018\n\n[-] Main References:\nhttps://github.com/libgme/game-music-emu/issues/166\nhttps://raw.githubusercontent.com/libgme/game-music-emu/0.6.5/gme/Gym_Emu.cpp\nhttps://github.com/libgme/game-music-emu\n\n[-] About NotCVE:\nNotCVE (https://notcve.org) assigns public, timestamped NotCVE IDs to\nvulnerabilities not acknowledged by vendors. Vendor will not assign a CVE?\nRequest a NotCVE: https://notcve.org/form/ \u00b7 Contributors:\nhttps://notcve.org/hall/\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-126",
"description": "CWE-126",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-02T04:57:33Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description",
"exploit"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/94"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Sep/94"
},
{
"url": "https://github.com/libgme/game-music-emu"
},
{
"url": "https://github.com/libgme/game-music-emu/issues/166"
},
{
"url": "https://github.com/netspacer1124"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://notcve.org"
},
{
"url": "https://notcve.org/form/"
},
{
"url": "https://notcve.org/hall/"
},
{
"url": "https://notcve.org/notcve/NotCVE-2026-0018"
},
{
"url": "https://raw.githubusercontent.com/libgme/game-music-emu/0.6.5/gme/Gym_Emu.cpp"
},
{
"url": "https://seclists.org/fulldisclosure/"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Sep/94"
],
"discovery": "EXTERNAL"
},
"title": "[NotCVE-2026-0018] game-music-emu (libgme) through 0.6.5 Unbounded GYM Command Loop Allows Heap Out-of-Bounds Read",
"x_gcve": [
{
"recordType": "advisory",
"relationships": [],
"vulnId": "GCVE-1988-2026-0422",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/94",
"automated": true,
"contentSha256": "3878efdb4d58d208a2366f5164763704bb97ed9449567c22ec0facdf3e2096b9",
"evidenceScore": 10,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/94",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-09-29T08:29:30Z"
}
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-10-02T04:57:33Z",
"dateUpdated": "2026-10-02T04:57:33Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0422"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
GCVE-1988-2026-0421
Vulnerability from gna-1988 – Published: 2026-10-02 04:57 – Updated: 2026-10-02 04:57
VLAI
EPSS
VEX
Title
[NotCVE-2026-0017] game-music-emu (libgme) 0.6.5 and Earlier AY Loader NULL Pointer Dereference Allows Denial of Service
Summary
----------------------------------------------------------------------------
NotCVE Advisory — NotCVE-2026-0017
----------------------------------------------------------------------------
[-] Summary:
A NULL pointer dereference in the AY file loader of game-music-emu
(libgme), the open-source video game music emulation library, allows an
attacker who supplies a crafted .ay file to terminate any application that
begins playback of it. CVSS:3.1 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H).
[-] Affected:
game-music-emu (libgme) 0.6.5 and earlier (present in 0.6.0 and 0.6.5),
and master as of commit fe8da4b. Default builds; no fixed version is
verified.
[-] Technical Description:
get_data() resolves the format's internal 16-bit relative offsets and
returns 0 when an offset word is 0x0000, as well as when the target would
fall outside the file buffer. The data-block copy loop in
Ay_Emu::start_track_() (gme/Ay_Emu.cpp) uses that result without testing
it:
- the block's source pointer comes from get_data( file, blocks, 0 ) and
is never compared against NULL;
- the only guard before the copy, if ( len > uint32_t (file.end - in) ),
compares len against the low 32 bits of the buffer's end address when
in == NULL, so it does not reliably clamp;
- execution reaches memcpy( mem.ram + addr, in, len ) with in == NULL.
The process terminates with SIGSEGV. The invalid access is a read from
address 0, so no attacker-controlled data is read or written; the impact
is denial of service of the process that parses the file.
Reachability: the AY handler is part of a default build
(option(USE_GME_AY ... ON)) and is reached from the public entry point
gme_start_track() via Music_Emu::start_track(). The condition is a
two-byte field in an otherwise structurally valid file, so it survives
type detection and track enumeration. FFmpeg documents optional use of the
library; the researcher additionally names VLC, Kodi and Audacious as
consumers.
Commit ae10a8f ("Ay_Emu.cpp: Don't read farther than buffer allows",
July 2026) changed get_data() to return 0 instead of asserting when the
pointer is out of range. That widens the set of inputs that produce a NULL
return in release builds and does not add the missing check.
Weaknesses:
CWE-476: NULL Pointer Dereference
CWE-252: Unchecked Return Value
CAPEC-165: File Manipulation
[-] Credit:
Discovered by netspacer1124 (https://github.com/netspacer1124).
[-] Full Details and Updates:
https://notcve.org/notcve/NotCVE-2026-0017
[-] Main References:
https://github.com/libgme/game-music-emu
https://github.com/libgme/game-music-emu/blob/0.6.5/gme/Ay_Emu.cpp
https://github.com/libgme/game-music-emu/commit/ae10a8f
[-] About NotCVE:
NotCVE (https://notcve.org) assigns public, timestamped NotCVE IDs to
vulnerabilities not acknowledged by vendors. Vendor will not assign a CVE?
Request a NotCVE: https://notcve.org/form/ · Contributors:
https://notcve.org/hall/
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
12 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| unknown | game-music-emu libgme |
Affected:
unknown
|
{
"containers": {
"cna": {
"affected": [
{
"product": "game-music-emu libgme",
"vendor": "unknown",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "advisories"
}
],
"descriptions": [
{
"lang": "en",
"value": "----------------------------------------------------------------------------\nNotCVE Advisory \u2014 NotCVE-2026-0017\n----------------------------------------------------------------------------\n\n[-] Summary:\nA NULL pointer dereference in the AY file loader of game-music-emu\n(libgme), the open-source video game music emulation library, allows an\nattacker who supplies a crafted .ay file to terminate any application that\nbegins playback of it. CVSS:3.1 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H).\n\n[-] Affected:\ngame-music-emu (libgme) 0.6.5 and earlier (present in 0.6.0 and 0.6.5),\nand master as of commit fe8da4b. Default builds; no fixed version is\nverified.\n\n[-] Technical Description:\nget_data() resolves the format\u0027s internal 16-bit relative offsets and\nreturns 0 when an offset word is 0x0000, as well as when the target would\nfall outside the file buffer. The data-block copy loop in\nAy_Emu::start_track_() (gme/Ay_Emu.cpp) uses that result without testing\nit:\n\n - the block\u0027s source pointer comes from get_data( file, blocks, 0 ) and\n is never compared against NULL;\n - the only guard before the copy, if ( len \u003e uint32_t (file.end - in) ),\n compares len against the low 32 bits of the buffer\u0027s end address when\n in == NULL, so it does not reliably clamp;\n - execution reaches memcpy( mem.ram + addr, in, len ) with in == NULL.\n\nThe process terminates with SIGSEGV. The invalid access is a read from\naddress 0, so no attacker-controlled data is read or written; the impact\nis denial of service of the process that parses the file.\n\nReachability: the AY handler is part of a default build\n(option(USE_GME_AY ... ON)) and is reached from the public entry point\ngme_start_track() via Music_Emu::start_track(). The condition is a\ntwo-byte field in an otherwise structurally valid file, so it survives\ntype detection and track enumeration. FFmpeg documents optional use of the\nlibrary; the researcher additionally names VLC, Kodi and Audacious as\nconsumers.\n\nCommit ae10a8f (\"Ay_Emu.cpp: Don\u0027t read farther than buffer allows\",\nJuly 2026) changed get_data() to return 0 instead of asserting when the\npointer is out of range. That widens the set of inputs that produce a NULL\nreturn in release builds and does not add the missing check.\n\nWeaknesses:\nCWE-476: NULL Pointer Dereference\nCWE-252: Unchecked Return Value\nCAPEC-165: File Manipulation\n\n[-] Credit:\nDiscovered by netspacer1124 (https://github.com/netspacer1124).\n\n[-] Full Details and Updates:\nhttps://notcve.org/notcve/NotCVE-2026-0017\n\n[-] Main References:\nhttps://github.com/libgme/game-music-emu\nhttps://github.com/libgme/game-music-emu/blob/0.6.5/gme/Ay_Emu.cpp\nhttps://github.com/libgme/game-music-emu/commit/ae10a8f\n\n[-] About NotCVE:\nNotCVE (https://notcve.org) assigns public, timestamped NotCVE IDs to\nvulnerabilities not acknowledged by vendors. Vendor will not assign a CVE?\nRequest a NotCVE: https://notcve.org/form/ \u00b7 Contributors:\nhttps://notcve.org/hall/\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-252",
"description": "CWE-252",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-476",
"description": "CWE-476",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-02T04:57:33Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/93"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Sep/93"
},
{
"url": "https://github.com/libgme/game-music-emu"
},
{
"url": "https://github.com/libgme/game-music-emu/blob/0.6.5/gme/Ay_Emu.cpp"
},
{
"url": "https://github.com/libgme/game-music-emu/commit/ae10a8f"
},
{
"url": "https://github.com/netspacer1124"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://notcve.org"
},
{
"url": "https://notcve.org/form/"
},
{
"url": "https://notcve.org/hall/"
},
{
"url": "https://notcve.org/notcve/NotCVE-2026-0017"
},
{
"url": "https://seclists.org/fulldisclosure/"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Sep/93"
],
"discovery": "EXTERNAL"
},
"title": "[NotCVE-2026-0017] game-music-emu (libgme) 0.6.5 and Earlier AY Loader NULL Pointer Dereference Allows Denial of Service",
"x_gcve": [
{
"recordType": "advisory",
"relationships": [],
"vulnId": "GCVE-1988-2026-0421",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/93",
"automated": true,
"contentSha256": "f4228a322dee4f4e825108e8305b1e84ce64d82c11ed5e593e413bfb1fc085e5",
"evidenceScore": 8,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/93",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-09-29T08:27:24Z"
}
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-10-02T04:57:33Z",
"dateUpdated": "2026-10-02T04:57:33Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0421"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}