{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "game-music-emu libgme",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "advisories"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "----------------------------------------------------------------------------\nNotCVE Advisory \u2014 NotCVE-2026-0017\n----------------------------------------------------------------------------\n\n[-] Summary:\nA NULL pointer dereference in the AY file loader of game-music-emu\n(libgme), the open-source video game music emulation library, allows an\nattacker who supplies a crafted .ay file to terminate any application that\nbegins playback of it. CVSS:3.1 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H).\n\n[-] Affected:\ngame-music-emu (libgme) 0.6.5 and earlier (present in 0.6.0 and 0.6.5),\nand master as of commit fe8da4b. Default builds; no fixed version is\nverified.\n\n[-] Technical Description:\nget_data() resolves the format\u0027s internal 16-bit relative offsets and\nreturns 0 when an offset word is 0x0000, as well as when the target would\nfall outside the file buffer. The data-block copy loop in\nAy_Emu::start_track_() (gme/Ay_Emu.cpp) uses that result without testing\nit:\n\n  - the block\u0027s source pointer comes from get_data( file, blocks, 0 ) and\n    is never compared against NULL;\n  - the only guard before the copy, if ( len \u003e uint32_t (file.end - in) ),\n    compares len against the low 32 bits of the buffer\u0027s end address when\n    in == NULL, so it does not reliably clamp;\n  - execution reaches memcpy( mem.ram + addr, in, len ) with in == NULL.\n\nThe process terminates with SIGSEGV. The invalid access is a read from\naddress 0, so no attacker-controlled data is read or written; the impact\nis denial of service of the process that parses the file.\n\nReachability: the AY handler is part of a default build\n(option(USE_GME_AY ... ON)) and is reached from the public entry point\ngme_start_track() via Music_Emu::start_track(). The condition is a\ntwo-byte field in an otherwise structurally valid file, so it survives\ntype detection and track enumeration. FFmpeg documents optional use of the\nlibrary; the researcher additionally names VLC, Kodi and Audacious as\nconsumers.\n\nCommit ae10a8f (\"Ay_Emu.cpp: Don\u0027t read farther than buffer allows\",\nJuly 2026) changed get_data() to return 0 instead of asserting when the\npointer is out of range. That widens the set of inputs that produce a NULL\nreturn in release builds and does not add the missing check.\n\nWeaknesses:\nCWE-476: NULL Pointer Dereference\nCWE-252: Unchecked Return Value\nCAPEC-165: File Manipulation\n\n[-] Credit:\nDiscovered by netspacer1124 (https://github.com/netspacer1124).\n\n[-] Full Details and Updates:\nhttps://notcve.org/notcve/NotCVE-2026-0017\n\n[-] Main References:\nhttps://github.com/libgme/game-music-emu\nhttps://github.com/libgme/game-music-emu/blob/0.6.5/gme/Ay_Emu.cpp\nhttps://github.com/libgme/game-music-emu/commit/ae10a8f\n\n[-] About NotCVE:\nNotCVE (https://notcve.org) assigns public, timestamped NotCVE IDs to\nvulnerabilities not acknowledged by vendors. Vendor will not assign a CVE?\nRequest a NotCVE: https://notcve.org/form/ \u00b7 Contributors:\nhttps://notcve.org/hall/\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-252",
              "description": "CWE-252",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-476",
              "description": "CWE-476",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-02T04:57:33Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/93"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Sep/93"
        },
        {
          "url": "https://github.com/libgme/game-music-emu"
        },
        {
          "url": "https://github.com/libgme/game-music-emu/blob/0.6.5/gme/Ay_Emu.cpp"
        },
        {
          "url": "https://github.com/libgme/game-music-emu/commit/ae10a8f"
        },
        {
          "url": "https://github.com/netspacer1124"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://notcve.org"
        },
        {
          "url": "https://notcve.org/form/"
        },
        {
          "url": "https://notcve.org/hall/"
        },
        {
          "url": "https://notcve.org/notcve/NotCVE-2026-0017"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Sep/93"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[NotCVE-2026-0017] game-music-emu (libgme) 0.6.5 and Earlier AY Loader NULL Pointer Dereference Allows Denial of Service",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0421",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/93",
            "automated": true,
            "contentSha256": "f4228a322dee4f4e825108e8305b1e84ce64d82c11ed5e593e413bfb1fc085e5",
            "evidenceScore": 8,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/93",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-09-29T08:27:24Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-10-02T04:57:33Z",
    "dateUpdated": "2026-10-02T04:57:33Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0421"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}