Vulnerability-Lookup

Search criteria

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CVE-2026-116727 (GCVE-0-2026-116727)

Vulnerability from nvd – Published: 2026-10-26 21:52 – Updated: 2026-10-26 21:52

Title

gbsplay through 0.0.103 Heap Out-of-Bounds Read via vgm_open in gbs.c

Summary

gbsplay through 0.0.103 contains a heap out-of-bounds read vulnerability in vgm_open() in gbs.c that walks the VGM command stream without bounds checks. Attackers can supply a crafted VGM file with wait opcodes and no 0x66 terminator to read past the heap buffer and crash the player.

Severity

4.8 (Medium)


                        
                          CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

3.3 (Low)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

CWE

CWE-125 - Out-of-bounds Read

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 7402 records in the last 180 days details

References

6 references

URL	Tags
https://github.com/mmitch/gbsplay/issues/201	issue-tracking
https://github.com/mmitch/gbsplay	product
https://github.com/mmitch/gbsplay/commit/91b1f6df…	patch
https://github.com/mmitch/gbsplay/blob/0.0.103/gb…	technical-description
https://hackmd.io/@haindpwn/gbsplay-rom-bank-inde…	third-party-advisory
https://www.vulncheck.com/advisories/gbsplay-thro…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
mmitch	gbsplay	Affected: 0 , ≤ 0.0.103 (custom)

Date Public

2026-10-22 00:00

Credits

HaiND from the Post and Telecommunication Institute of Technology

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/mmitch/gbsplay",
          "product": "gbsplay",
          "repo": "https://github.com/mmitch/gbsplay",
          "vendor": "mmitch",
          "versions": [
            {
              "lessThanOrEqual": "0.0.103",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "HaiND from the Post and Telecommunication Institute of Technology"
        }
      ],
      "datePublic": "2026-10-22T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "gbsplay through 0.0.103 contains a heap out-of-bounds read vulnerability in vgm_open() in gbs.c that walks the VGM command stream without bounds checks. Attackers can supply a crafted VGM file with wait opcodes and no 0x66 terminator to read past the heap buffer and crash the player."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-26T21:52:30.198Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Issue #201",
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/mmitch/gbsplay/issues/201"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/mmitch/gbsplay"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/mmitch/gbsplay/commit/91b1f6df0abd3914f91caa528ec3213d731999e8"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/mmitch/gbsplay/blob/0.0.103/gbs.c#L996-L1010"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://hackmd.io/@haindpwn/gbsplay-rom-bank-index-oob-read"
        },
        {
          "name": "VulnCheck Advisory: gbsplay through 0.0.103 Heap Out-of-Bounds Read via vgm_open in gbs.c",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/gbsplay-through-0.0.103-heap-out-of-bounds-read-via-vgm-open-in-gbs-c"
        }
      ],
      "title": "gbsplay through 0.0.103 Heap Out-of-Bounds Read via vgm_open in gbs.c",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-116727",
    "datePublished": "2026-10-26T21:52:30.198Z",
    "dateReserved": "2026-10-26T20:23:34.577Z",
    "dateUpdated": "2026-10-26T21:52:30.198Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-116726 (GCVE-0-2026-116726)

Vulnerability from nvd – Published: 2026-10-26 21:52 – Updated: 2026-10-27 14:17

Title

gbsplay through 0.0.103 Heap Out-of-Bounds Read via gbr_open GBR Title

Summary

Gbsplay through 0.0.103 contains a heap out-of-bounds read vulnerability in gbr_open() in gbs.c that fails to verify file length before scanning the GBR ROM title field. Attackers can supply a crafted GBR file of 0x21 to 0x162 bytes to read past the heap buffer, crashing gbsplay or leaking memory.

Severity

4.8 (Medium)


                        
                          CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

3.3 (Low)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-27 13:41 UTC

CWE

CWE-125 - Out-of-bounds Read

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 7402 records in the last 180 days details

References

6 references

URL	Tags
https://github.com/mmitch/gbsplay/issues/201	issue-tracking
https://github.com/mmitch/gbsplay	product
https://github.com/mmitch/gbsplay/commit/33812ed3…	patch
https://github.com/mmitch/gbsplay/blob/0.0.103/gb…	technical-description
https://hackmd.io/@haindpwn/gbsplay-rom-bank-inde…	third-party-advisory
https://www.vulncheck.com/advisories/gbsplay-thro…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
mmitch	gbsplay	Affected: 0 , ≤ 0.0.103 (custom)

Date Public

2026-10-22 00:00

Credits

HaiND from the Post and Telecommunication Institute of Technology

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-116726",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-27T13:41:56.170379Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-27T14:17:32.379Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/mmitch/gbsplay",
          "product": "gbsplay",
          "repo": "https://github.com/mmitch/gbsplay",
          "vendor": "mmitch",
          "versions": [
            {
              "lessThanOrEqual": "0.0.103",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "HaiND from the Post and Telecommunication Institute of Technology"
        }
      ],
      "datePublic": "2026-10-22T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Gbsplay through 0.0.103 contains a heap out-of-bounds read vulnerability in gbr_open() in gbs.c that fails to verify file length before scanning the GBR ROM title field. Attackers can supply a crafted GBR file of 0x21 to 0x162 bytes to read past the heap buffer, crashing gbsplay or leaking memory."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-26T21:52:29.528Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Issue #201",
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/mmitch/gbsplay/issues/201"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/mmitch/gbsplay"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/mmitch/gbsplay/commit/33812ed38d84b800b5a17f639ef6625f76290785"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/mmitch/gbsplay/blob/0.0.103/gbs.c#L810-L820"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://hackmd.io/@haindpwn/gbsplay-rom-bank-index-oob-read"
        },
        {
          "name": "VulnCheck Advisory: gbsplay through 0.0.103 Heap Out-of-Bounds Read via gbr_open GBR Title",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/gbsplay-through-0.0.103-heap-out-of-bounds-read-via-gbr-open-gbr-title"
        }
      ],
      "title": "gbsplay through 0.0.103 Heap Out-of-Bounds Read via gbr_open GBR Title",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-116726",
    "datePublished": "2026-10-26T21:52:29.528Z",
    "dateReserved": "2026-10-26T20:23:34.436Z",
    "dateUpdated": "2026-10-27T14:17:32.379Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-116725 (GCVE-0-2026-116725)

Vulnerability from nvd – Published: 2026-10-26 21:52 – Updated: 2026-11-02 18:20

Title

gbsplay through 0.0.103 Out-of-Bounds Read via mapper_map ROM Bank Index

Summary

gbsplay through 0.0.103 contains an out-of-bounds read vulnerability in mapper_map() in mapper.c that fails to reject ROM bank indexes beyond the ROM size, causing an underflowed bank length. Attackers can supply crafted .gbr, .gbs or .gb files with malicious bank indexes to make bank_get() read far past the heap ROM buffer and crash the player.

Severity

6.8 (Medium)


                        
                          CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-02 18:19 UTC

CWE

CWE-125 - Out-of-bounds Read

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 7402 records in the last 180 days details

References

7 references

URL	Tags
https://github.com/mmitch/gbsplay/issues/201	issue-tracking
https://github.com/mmitch/gbsplay	product
https://github.com/mmitch/gbsplay/commit/a281d80b…	patch
https://github.com/mmitch/gbsplay/blob/0.0.103/ma…	technical-description
https://hackmd.io/@haindpwn/gbsplay-rom-bank-inde…	third-party-advisory
https://www.vulncheck.com/advisories/gbsplay-thro…	third-party-advisory
https://hackmd.io/@haindpwn/cve-2026-116725-11672…	exploit

Impacted products

1 product

Vendor	Product	Version
mmitch	gbsplay	Affected: 0 , ≤ 0.0.103 (custom)

Date Public

2026-10-22 00:00

Credits

HaiND from the Post and Telecommunication Institute of Technology

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-116725",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-02T18:19:54.193332Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-02T18:20:53.778Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://hackmd.io/@haindpwn/cve-2026-116725-116726-116727-gbsplay-rom-bank-index-oob-read#Attack-flow"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/mmitch/gbsplay",
          "product": "gbsplay",
          "repo": "https://github.com/mmitch/gbsplay",
          "vendor": "mmitch",
          "versions": [
            {
              "lessThanOrEqual": "0.0.103",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "HaiND from the Post and Telecommunication Institute of Technology"
        }
      ],
      "datePublic": "2026-10-22T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "gbsplay through 0.0.103 contains an out-of-bounds read vulnerability in mapper_map() in mapper.c that fails to reject ROM bank indexes beyond the ROM size, causing an underflowed bank length. Attackers can supply crafted .gbr, .gbs or .gb files with malicious bank indexes to make bank_get() read far past the heap ROM buffer and crash the player."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-26T21:52:28.842Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Issue #201",
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/mmitch/gbsplay/issues/201"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/mmitch/gbsplay"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/mmitch/gbsplay/commit/a281d80bc56ed63347daf740a2f7aa4f8516165a"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/mmitch/gbsplay/blob/0.0.103/mapper.c#L71-L103"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://hackmd.io/@haindpwn/gbsplay-rom-bank-index-oob-read"
        },
        {
          "name": "VulnCheck Advisory: gbsplay through 0.0.103 Out-of-Bounds Read via mapper_map ROM Bank Index",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/gbsplay-through-0.0.103-out-of-bounds-read-via-mapper-map-rom-bank-index"
        }
      ],
      "title": "gbsplay through 0.0.103 Out-of-Bounds Read via mapper_map ROM Bank Index",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-116725",
    "datePublished": "2026-10-26T21:52:28.842Z",
    "dateReserved": "2026-10-26T20:23:34.290Z",
    "dateUpdated": "2026-11-02T18:20:53.778Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-116727 (GCVE-0-2026-116727)

Vulnerability from cvelistv5 – Published: 2026-10-26 21:52 – Updated: 2026-10-26 21:52

Title

gbsplay through 0.0.103 Heap Out-of-Bounds Read via vgm_open in gbs.c

Summary

gbsplay through 0.0.103 contains a heap out-of-bounds read vulnerability in vgm_open() in gbs.c that walks the VGM command stream without bounds checks. Attackers can supply a crafted VGM file with wait opcodes and no 0x66 terminator to read past the heap buffer and crash the player.

Severity

4.8 (Medium)


                        
                          CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

3.3 (Low)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

CWE

CWE-125 - Out-of-bounds Read

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 7402 records in the last 180 days details

References

6 references

URL	Tags
https://github.com/mmitch/gbsplay/issues/201	issue-tracking
https://github.com/mmitch/gbsplay	product
https://github.com/mmitch/gbsplay/commit/91b1f6df…	patch
https://github.com/mmitch/gbsplay/blob/0.0.103/gb…	technical-description
https://hackmd.io/@haindpwn/gbsplay-rom-bank-inde…	third-party-advisory
https://www.vulncheck.com/advisories/gbsplay-thro…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
mmitch	gbsplay	Affected: 0 , ≤ 0.0.103 (custom)

Date Public

2026-10-22 00:00

Credits

HaiND from the Post and Telecommunication Institute of Technology

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/mmitch/gbsplay",
          "product": "gbsplay",
          "repo": "https://github.com/mmitch/gbsplay",
          "vendor": "mmitch",
          "versions": [
            {
              "lessThanOrEqual": "0.0.103",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "HaiND from the Post and Telecommunication Institute of Technology"
        }
      ],
      "datePublic": "2026-10-22T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "gbsplay through 0.0.103 contains a heap out-of-bounds read vulnerability in vgm_open() in gbs.c that walks the VGM command stream without bounds checks. Attackers can supply a crafted VGM file with wait opcodes and no 0x66 terminator to read past the heap buffer and crash the player."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-26T21:52:30.198Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Issue #201",
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/mmitch/gbsplay/issues/201"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/mmitch/gbsplay"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/mmitch/gbsplay/commit/91b1f6df0abd3914f91caa528ec3213d731999e8"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/mmitch/gbsplay/blob/0.0.103/gbs.c#L996-L1010"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://hackmd.io/@haindpwn/gbsplay-rom-bank-index-oob-read"
        },
        {
          "name": "VulnCheck Advisory: gbsplay through 0.0.103 Heap Out-of-Bounds Read via vgm_open in gbs.c",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/gbsplay-through-0.0.103-heap-out-of-bounds-read-via-vgm-open-in-gbs-c"
        }
      ],
      "title": "gbsplay through 0.0.103 Heap Out-of-Bounds Read via vgm_open in gbs.c",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-116727",
    "datePublished": "2026-10-26T21:52:30.198Z",
    "dateReserved": "2026-10-26T20:23:34.577Z",
    "dateUpdated": "2026-10-26T21:52:30.198Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-116726 (GCVE-0-2026-116726)

Vulnerability from cvelistv5 – Published: 2026-10-26 21:52 – Updated: 2026-10-27 14:17

Title

gbsplay through 0.0.103 Heap Out-of-Bounds Read via gbr_open GBR Title

Summary

Gbsplay through 0.0.103 contains a heap out-of-bounds read vulnerability in gbr_open() in gbs.c that fails to verify file length before scanning the GBR ROM title field. Attackers can supply a crafted GBR file of 0x21 to 0x162 bytes to read past the heap buffer, crashing gbsplay or leaking memory.

Severity

4.8 (Medium)


                        
                          CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

3.3 (Low)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-27 13:41 UTC

CWE

CWE-125 - Out-of-bounds Read

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 7402 records in the last 180 days details

References

6 references

URL	Tags
https://github.com/mmitch/gbsplay/issues/201	issue-tracking
https://github.com/mmitch/gbsplay	product
https://github.com/mmitch/gbsplay/commit/33812ed3…	patch
https://github.com/mmitch/gbsplay/blob/0.0.103/gb…	technical-description
https://hackmd.io/@haindpwn/gbsplay-rom-bank-inde…	third-party-advisory
https://www.vulncheck.com/advisories/gbsplay-thro…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
mmitch	gbsplay	Affected: 0 , ≤ 0.0.103 (custom)

Date Public

2026-10-22 00:00

Credits

HaiND from the Post and Telecommunication Institute of Technology

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-116726",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-27T13:41:56.170379Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-27T14:17:32.379Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/mmitch/gbsplay",
          "product": "gbsplay",
          "repo": "https://github.com/mmitch/gbsplay",
          "vendor": "mmitch",
          "versions": [
            {
              "lessThanOrEqual": "0.0.103",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "HaiND from the Post and Telecommunication Institute of Technology"
        }
      ],
      "datePublic": "2026-10-22T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Gbsplay through 0.0.103 contains a heap out-of-bounds read vulnerability in gbr_open() in gbs.c that fails to verify file length before scanning the GBR ROM title field. Attackers can supply a crafted GBR file of 0x21 to 0x162 bytes to read past the heap buffer, crashing gbsplay or leaking memory."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-26T21:52:29.528Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Issue #201",
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/mmitch/gbsplay/issues/201"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/mmitch/gbsplay"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/mmitch/gbsplay/commit/33812ed38d84b800b5a17f639ef6625f76290785"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/mmitch/gbsplay/blob/0.0.103/gbs.c#L810-L820"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://hackmd.io/@haindpwn/gbsplay-rom-bank-index-oob-read"
        },
        {
          "name": "VulnCheck Advisory: gbsplay through 0.0.103 Heap Out-of-Bounds Read via gbr_open GBR Title",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/gbsplay-through-0.0.103-heap-out-of-bounds-read-via-gbr-open-gbr-title"
        }
      ],
      "title": "gbsplay through 0.0.103 Heap Out-of-Bounds Read via gbr_open GBR Title",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-116726",
    "datePublished": "2026-10-26T21:52:29.528Z",
    "dateReserved": "2026-10-26T20:23:34.436Z",
    "dateUpdated": "2026-10-27T14:17:32.379Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-116725 (GCVE-0-2026-116725)

Vulnerability from cvelistv5 – Published: 2026-10-26 21:52 – Updated: 2026-11-02 18:20

Title

gbsplay through 0.0.103 Out-of-Bounds Read via mapper_map ROM Bank Index

Summary

gbsplay through 0.0.103 contains an out-of-bounds read vulnerability in mapper_map() in mapper.c that fails to reject ROM bank indexes beyond the ROM size, causing an underflowed bank length. Attackers can supply crafted .gbr, .gbs or .gb files with malicious bank indexes to make bank_get() read far past the heap ROM buffer and crash the player.

Severity

6.8 (Medium)


                        
                          CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-02 18:19 UTC

CWE

CWE-125 - Out-of-bounds Read

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 7402 records in the last 180 days details

References

7 references

URL	Tags
https://github.com/mmitch/gbsplay/issues/201	issue-tracking
https://github.com/mmitch/gbsplay	product
https://github.com/mmitch/gbsplay/commit/a281d80b…	patch
https://github.com/mmitch/gbsplay/blob/0.0.103/ma…	technical-description
https://hackmd.io/@haindpwn/gbsplay-rom-bank-inde…	third-party-advisory
https://www.vulncheck.com/advisories/gbsplay-thro…	third-party-advisory
https://hackmd.io/@haindpwn/cve-2026-116725-11672…	exploit

Impacted products

1 product

Vendor	Product	Version
mmitch	gbsplay	Affected: 0 , ≤ 0.0.103 (custom)

Date Public

2026-10-22 00:00

Credits

HaiND from the Post and Telecommunication Institute of Technology

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-116725",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-02T18:19:54.193332Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-02T18:20:53.778Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://hackmd.io/@haindpwn/cve-2026-116725-116726-116727-gbsplay-rom-bank-index-oob-read#Attack-flow"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/mmitch/gbsplay",
          "product": "gbsplay",
          "repo": "https://github.com/mmitch/gbsplay",
          "vendor": "mmitch",
          "versions": [
            {
              "lessThanOrEqual": "0.0.103",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "HaiND from the Post and Telecommunication Institute of Technology"
        }
      ],
      "datePublic": "2026-10-22T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "gbsplay through 0.0.103 contains an out-of-bounds read vulnerability in mapper_map() in mapper.c that fails to reject ROM bank indexes beyond the ROM size, causing an underflowed bank length. Attackers can supply crafted .gbr, .gbs or .gb files with malicious bank indexes to make bank_get() read far past the heap ROM buffer and crash the player."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-26T21:52:28.842Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Issue #201",
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/mmitch/gbsplay/issues/201"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/mmitch/gbsplay"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/mmitch/gbsplay/commit/a281d80bc56ed63347daf740a2f7aa4f8516165a"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/mmitch/gbsplay/blob/0.0.103/mapper.c#L71-L103"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://hackmd.io/@haindpwn/gbsplay-rom-bank-index-oob-read"
        },
        {
          "name": "VulnCheck Advisory: gbsplay through 0.0.103 Out-of-Bounds Read via mapper_map ROM Bank Index",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/gbsplay-through-0.0.103-out-of-bounds-read-via-mapper-map-rom-bank-index"
        }
      ],
      "title": "gbsplay through 0.0.103 Out-of-Bounds Read via mapper_map ROM Bank Index",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-116725",
    "datePublished": "2026-10-26T21:52:28.842Z",
    "dateReserved": "2026-10-26T20:23:34.290Z",
    "dateUpdated": "2026-11-02T18:20:53.778Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Find a vulnerability

Search criteria

6 vulnerabilities by mmitch

CVE-2026-116727 (GCVE-0-2026-116727)

CVE-2026-116726 (GCVE-0-2026-116726)

CVE-2026-116725 (GCVE-0-2026-116725)

CVE-2026-116727 (GCVE-0-2026-116727)

CVE-2026-116726 (GCVE-0-2026-116726)

CVE-2026-116725 (GCVE-0-2026-116725)