{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "game-music-emu libgme",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "advisories"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "----------------------------------------------------------------------------\nNotCVE Advisory \u2014 NotCVE-2026-0018\n----------------------------------------------------------------------------\n\n[-] Summary:\nAn out-of-bounds read in the GYM playback path of game-music-emu (libgme),\nthe open-source video game music emulation library, allows an attacker who\nsupplies a crafted .gym file to read heap memory past the end of the\nallocation holding the file contents, potentially terminating the process.\nCVSS:3.1 5.4 (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L).\n\n[-] Affected:\ngame-music-emu (libgme) through 0.6.5 (present since at least 0.5.5), and\nmaster as of commit fe8da4b. No fixed version is verified: upstream issue\n#166, opened on 13 July 2026, describes the parse_frame defect and has had\nno maintainer response.\n\n[-] Technical Description:\nThe command loop of Gym_Emu::parse_frame() in gme/Gym_Emu.cpp is\n\n  while ( (cmd = *pos++) != 0 )\n\nand terminates only on a 0x00 byte, with no bound against data_end.\nOperands are then read unconditionally after the opcode: int data = *pos++\nand, for a YM2612 port-0 register write (cmd == 1), a second\nint data2 = *pos++. A file whose final frame ends mid-command therefore\nreads 1 to 2 bytes past the end of the buffer. The if ( pos \u003e= data_end )\ncheck only runs after the loop has already walked off the end.\n\nA second, broader unbounded scan exists in run_dac(), which looks ahead\nwith while ( (cmd = *p++) != 0 ) and no data_end bound at all. When the\nfinal frame contains a DAC write (YM2612 register 0x2A on port 0) and no\n0x00 follows before the end of the allocation, it can walk arbitrarily far\npast the buffer, stopping on whatever zero byte adjacent heap memory\nsupplies. This second path is confirmed by reading the source at master\nand 0.6.5, but is not exercised by the supplied proof-of-concept files.\n\nReachability: both paths run from gme_start_track() as soon as playback\nbegins (Music_Emu::start_track() -\u003e ... -\u003e Gym_Emu::play_frame() -\u003e\nparse_frame()). The file only needs the 428-byte GYMX header for\ngme_identify_header() to route it to Gym_Emu. FFmpeg\u0027s\nlibavformat/libgme.c and VLC\u0027s modules/demux/gme.c both hand\nattacker-supplied bytes to this path. The metadata (track length) path is\nnot affected.\n\nWeaknesses:\nCWE-125: Out-of-bounds Read\nCWE-126: Buffer Over-read\nCAPEC-540: Overread Buffers\n\n[-] Credit:\nDiscovered by netspacer1124 (https://github.com/netspacer1124).\n\n[-] Full Details and Updates:\nhttps://notcve.org/notcve/NotCVE-2026-0018\n\n[-] Main References:\nhttps://github.com/libgme/game-music-emu/issues/166\nhttps://raw.githubusercontent.com/libgme/game-music-emu/0.6.5/gme/Gym_Emu.cpp\nhttps://github.com/libgme/game-music-emu\n\n[-] About NotCVE:\nNotCVE (https://notcve.org) assigns public, timestamped NotCVE IDs to\nvulnerabilities not acknowledged by vendors. Vendor will not assign a CVE?\nRequest a NotCVE: https://notcve.org/form/ \u00b7 Contributors:\nhttps://notcve.org/hall/\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "CWE-125",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-126",
              "description": "CWE-126",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-02T04:57:33Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/94"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Sep/94"
        },
        {
          "url": "https://github.com/libgme/game-music-emu"
        },
        {
          "url": "https://github.com/libgme/game-music-emu/issues/166"
        },
        {
          "url": "https://github.com/netspacer1124"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://notcve.org"
        },
        {
          "url": "https://notcve.org/form/"
        },
        {
          "url": "https://notcve.org/hall/"
        },
        {
          "url": "https://notcve.org/notcve/NotCVE-2026-0018"
        },
        {
          "url": "https://raw.githubusercontent.com/libgme/game-music-emu/0.6.5/gme/Gym_Emu.cpp"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Sep/94"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[NotCVE-2026-0018] game-music-emu (libgme) through 0.6.5 Unbounded GYM Command Loop Allows Heap Out-of-Bounds Read",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0422",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/94",
            "automated": true,
            "contentSha256": "3878efdb4d58d208a2366f5164763704bb97ed9449567c22ec0facdf3e2096b9",
            "evidenceScore": 10,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/94",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-09-29T08:29:30Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-10-02T04:57:33Z",
    "dateUpdated": "2026-10-02T04:57:33Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0422"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}