Description (en)
----------------------------------------------------------------------------
NotCVE Advisory — NotCVE-2026-0017
----------------------------------------------------------------------------
[-] Summary:
A NULL pointer dereference in the AY file loader of game-music-emu
(libgme), the open-source video game music emulation library, allows an
attacker who supplies a crafted .ay file to terminate any application that
begins playback of it. CVSS:3.1 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H).
[-] Affected:
game-music-emu (libgme) 0.6.5 and earlier (present in 0.6.0 and 0.6.5),
and master as of commit fe8da4b. Default builds; no fixed version is
verified.
[-] Technical Description:
get_data() resolves the format's internal 16-bit relative offsets and
returns 0 when an offset word is 0x0000, as well as when the target would
fall outside the file buffer. The data-block copy loop in
Ay_Emu::start_track_() (gme/Ay_Emu.cpp) uses that result without testing
it:
- the block's source pointer comes from get_data( file, blocks, 0 ) and
is never compared against NULL;
- the only guard before the copy, if ( len > uint32_t (file.end - in) ),
compares len against the low 32 bits of the buffer's end address when
in == NULL, so it does not reliably clamp;
- execution reaches memcpy( mem.ram + addr, in, len ) with in == NULL.
The process terminates with SIGSEGV. The invalid access is a read from
address 0, so no attacker-controlled data is read or written; the impact
is denial of service of the process that parses the file.
Reachability: the AY handler is part of a default build
(option(USE_GME_AY ... ON)) and is reached from the public entry point
gme_start_track() via Music_Emu::start_track(). The condition is a
two-byte field in an otherwise structurally valid file, so it survives
type detection and track enumeration. FFmpeg documents optional use of the
library; the researcher additionally names VLC, Kodi and Audacious as
consumers.
Commit ae10a8f ("Ay_Emu.cpp: Don't read farther than buffer allows",
July 2026) changed get_data() to return 0 instead of asserting when the
pointer is out of range. That widens the set of inputs that produce a NULL
return in release builds and does not add the missing check.
Weaknesses:
CWE-476: NULL Pointer Dereference
CWE-252: Unchecked Return Value
CAPEC-165: File Manipulation
[-] Credit:
Discovered by netspacer1124 (https://github.com/netspacer1124).
[-] Full Details and Updates:
https://notcve.org/notcve/NotCVE-2026-0017
[-] Main References:
https://github.com/libgme/game-music-emu
https://github.com/libgme/game-music-emu/blob/0.6.5/gme/Ay_Emu.cpp
https://github.com/libgme/game-music-emu/commit/ae10a8f
[-] About NotCVE:
NotCVE (https://notcve.org) assigns public, timestamped NotCVE IDs to
vulnerabilities not acknowledged by vendors. Vendor will not assign a CVE?
Request a NotCVE: https://notcve.org/form/ · Contributors:
https://notcve.org/hall/
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/Raw JSON
{
"containers": {
"cna": {
"affected": [
{
"product": "game-music-emu libgme",
"vendor": "unknown",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "advisories"
}
],
"descriptions": [
{
"lang": "en",
"value": "----------------------------------------------------------------------------\nNotCVE Advisory — NotCVE-2026-0017\n----------------------------------------------------------------------------\n\n[-] Summary:\nA NULL pointer dereference in the AY file loader of game-music-emu\n(libgme), the open-source video game music emulation library, allows an\nattacker who supplies a crafted .ay file to terminate any application that\nbegins playback of it. CVSS:3.1 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H).\n\n[-] Affected:\ngame-music-emu (libgme) 0.6.5 and earlier (present in 0.6.0 and 0.6.5),\nand master as of commit fe8da4b. Default builds; no fixed version is\nverified.\n\n[-] Technical Description:\nget_data() resolves the format's internal 16-bit relative offsets and\nreturns 0 when an offset word is 0x0000, as well as when the target would\nfall outside the file buffer. The data-block copy loop in\nAy_Emu::start_track_() (gme/Ay_Emu.cpp) uses that result without testing\nit:\n\n - the block's source pointer comes from get_data( file, blocks, 0 ) and\n is never compared against NULL;\n - the only guard before the copy, if ( len > uint32_t (file.end - in) ),\n compares len against the low 32 bits of the buffer's end address when\n in == NULL, so it does not reliably clamp;\n - execution reaches memcpy( mem.ram + addr, in, len ) with in == NULL.\n\nThe process terminates with SIGSEGV. The invalid access is a read from\naddress 0, so no attacker-controlled data is read or written; the impact\nis denial of service of the process that parses the file.\n\nReachability: the AY handler is part of a default build\n(option(USE_GME_AY ... ON)) and is reached from the public entry point\ngme_start_track() via Music_Emu::start_track(). The condition is a\ntwo-byte field in an otherwise structurally valid file, so it survives\ntype detection and track enumeration. FFmpeg documents optional use of the\nlibrary; the researcher additionally names VLC, Kodi and Audacious as\nconsumers.\n\nCommit ae10a8f (\"Ay_Emu.cpp: Don't read farther than buffer allows\",\nJuly 2026) changed get_data() to return 0 instead of asserting when the\npointer is out of range. That widens the set of inputs that produce a NULL\nreturn in release builds and does not add the missing check.\n\nWeaknesses:\nCWE-476: NULL Pointer Dereference\nCWE-252: Unchecked Return Value\nCAPEC-165: File Manipulation\n\n[-] Credit:\nDiscovered by netspacer1124 (https://github.com/netspacer1124).\n\n[-] Full Details and Updates:\nhttps://notcve.org/notcve/NotCVE-2026-0017\n\n[-] Main References:\nhttps://github.com/libgme/game-music-emu\nhttps://github.com/libgme/game-music-emu/blob/0.6.5/gme/Ay_Emu.cpp\nhttps://github.com/libgme/game-music-emu/commit/ae10a8f\n\n[-] About NotCVE:\nNotCVE (https://notcve.org) assigns public, timestamped NotCVE IDs to\nvulnerabilities not acknowledged by vendors. Vendor will not assign a CVE?\nRequest a NotCVE: https://notcve.org/form/ · Contributors:\nhttps://notcve.org/hall/\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives & RSS: https://seclists.org/fulldisclosure/"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-252",
"description": "CWE-252",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-476",
"description": "CWE-476",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-02T04:57:33Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/93"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Sep/93"
},
{
"url": "https://github.com/libgme/game-music-emu"
},
{
"url": "https://github.com/libgme/game-music-emu/blob/0.6.5/gme/Ay_Emu.cpp"
},
{
"url": "https://github.com/libgme/game-music-emu/commit/ae10a8f"
},
{
"url": "https://github.com/netspacer1124"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://notcve.org"
},
{
"url": "https://notcve.org/form/"
},
{
"url": "https://notcve.org/hall/"
},
{
"url": "https://notcve.org/notcve/NotCVE-2026-0017"
},
{
"url": "https://seclists.org/fulldisclosure/"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Sep/93"
],
"discovery": "EXTERNAL"
},
"title": "[NotCVE-2026-0017] game-music-emu (libgme) 0.6.5 and Earlier AY Loader NULL Pointer Dereference Allows Denial of Service",
"x_gcve": [
{
"recordType": "advisory",
"relationships": [],
"vulnId": "GCVE-1988-2026-0421",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/93",
"automated": true,
"contentSha256": "f4228a322dee4f4e825108e8305b1e84ce64d82c11ed5e593e413bfb1fc085e5",
"evidenceScore": 8,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/93",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-09-29T08:27:24Z"
}
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-10-02T04:57:33Z",
"dateUpdated": "2026-10-02T04:57:33Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0421"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}