Description (en)
----------------------------------------------------------------------------
NotCVE Advisory — NotCVE-2026-0018
----------------------------------------------------------------------------
[-] Summary:
An out-of-bounds read in the GYM playback path of game-music-emu (libgme),
the open-source video game music emulation library, allows an attacker who
supplies a crafted .gym file to read heap memory past the end of the
allocation holding the file contents, potentially terminating the process.
CVSS:3.1 5.4 (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L).
[-] Affected:
game-music-emu (libgme) through 0.6.5 (present since at least 0.5.5), and
master as of commit fe8da4b. No fixed version is verified: upstream issue
#166, opened on 13 July 2026, describes the parse_frame defect and has had
no maintainer response.
[-] Technical Description:
The command loop of Gym_Emu::parse_frame() in gme/Gym_Emu.cpp is
while ( (cmd = *pos++) != 0 )
and terminates only on a 0x00 byte, with no bound against data_end.
Operands are then read unconditionally after the opcode: int data = *pos++
and, for a YM2612 port-0 register write (cmd == 1), a second
int data2 = *pos++. A file whose final frame ends mid-command therefore
reads 1 to 2 bytes past the end of the buffer. The if ( pos >= data_end )
check only runs after the loop has already walked off the end.
A second, broader unbounded scan exists in run_dac(), which looks ahead
with while ( (cmd = *p++) != 0 ) and no data_end bound at all. When the
final frame contains a DAC write (YM2612 register 0x2A on port 0) and no
0x00 follows before the end of the allocation, it can walk arbitrarily far
past the buffer, stopping on whatever zero byte adjacent heap memory
supplies. This second path is confirmed by reading the source at master
and 0.6.5, but is not exercised by the supplied proof-of-concept files.
Reachability: both paths run from gme_start_track() as soon as playback
begins (Music_Emu::start_track() -> ... -> Gym_Emu::play_frame() ->
parse_frame()). The file only needs the 428-byte GYMX header for
gme_identify_header() to route it to Gym_Emu. FFmpeg's
libavformat/libgme.c and VLC's modules/demux/gme.c both hand
attacker-supplied bytes to this path. The metadata (track length) path is
not affected.
Weaknesses:
CWE-125: Out-of-bounds Read
CWE-126: Buffer Over-read
CAPEC-540: Overread Buffers
[-] Credit:
Discovered by netspacer1124 (https://github.com/netspacer1124).
[-] Full Details and Updates:
https://notcve.org/notcve/NotCVE-2026-0018
[-] Main References:
https://github.com/libgme/game-music-emu/issues/166
https://raw.githubusercontent.com/libgme/game-music-emu/0.6.5/gme/Gym_Emu.cpp
https://github.com/libgme/game-music-emu
[-] About NotCVE:
NotCVE (https://notcve.org) assigns public, timestamped NotCVE IDs to
vulnerabilities not acknowledged by vendors. Vendor will not assign a CVE?
Request a NotCVE: https://notcve.org/form/ · Contributors:
https://notcve.org/hall/
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/
Raw JSON
{
"containers": {
"cna": {
"affected": [
{
"product": "game-music-emu libgme",
"vendor": "unknown",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "advisories"
}
],
"descriptions": [
{
"lang": "en",
"value": "----------------------------------------------------------------------------\nNotCVE Advisory — NotCVE-2026-0018\n----------------------------------------------------------------------------\n\n[-] Summary:\nAn out-of-bounds read in the GYM playback path of game-music-emu (libgme),\nthe open-source video game music emulation library, allows an attacker who\nsupplies a crafted .gym file to read heap memory past the end of the\nallocation holding the file contents, potentially terminating the process.\nCVSS:3.1 5.4 (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L).\n\n[-] Affected:\ngame-music-emu (libgme) through 0.6.5 (present since at least 0.5.5), and\nmaster as of commit fe8da4b. No fixed version is verified: upstream issue\n#166, opened on 13 July 2026, describes the parse_frame defect and has had\nno maintainer response.\n\n[-] Technical Description:\nThe command loop of Gym_Emu::parse_frame() in gme/Gym_Emu.cpp is\n\n while ( (cmd = *pos++) != 0 )\n\nand terminates only on a 0x00 byte, with no bound against data_end.\nOperands are then read unconditionally after the opcode: int data = *pos++\nand, for a YM2612 port-0 register write (cmd == 1), a second\nint data2 = *pos++. A file whose final frame ends mid-command therefore\nreads 1 to 2 bytes past the end of the buffer. The if ( pos >= data_end )\ncheck only runs after the loop has already walked off the end.\n\nA second, broader unbounded scan exists in run_dac(), which looks ahead\nwith while ( (cmd = *p++) != 0 ) and no data_end bound at all. When the\nfinal frame contains a DAC write (YM2612 register 0x2A on port 0) and no\n0x00 follows before the end of the allocation, it can walk arbitrarily far\npast the buffer, stopping on whatever zero byte adjacent heap memory\nsupplies. This second path is confirmed by reading the source at master\nand 0.6.5, but is not exercised by the supplied proof-of-concept files.\n\nReachability: both paths run from gme_start_track() as soon as playback\nbegins (Music_Emu::start_track() -> ... -> Gym_Emu::play_frame() ->\nparse_frame()). The file only needs the 428-byte GYMX header for\ngme_identify_header() to route it to Gym_Emu. FFmpeg's\nlibavformat/libgme.c and VLC's modules/demux/gme.c both hand\nattacker-supplied bytes to this path. The metadata (track length) path is\nnot affected.\n\nWeaknesses:\nCWE-125: Out-of-bounds Read\nCWE-126: Buffer Over-read\nCAPEC-540: Overread Buffers\n\n[-] Credit:\nDiscovered by netspacer1124 (https://github.com/netspacer1124).\n\n[-] Full Details and Updates:\nhttps://notcve.org/notcve/NotCVE-2026-0018\n\n[-] Main References:\nhttps://github.com/libgme/game-music-emu/issues/166\nhttps://raw.githubusercontent.com/libgme/game-music-emu/0.6.5/gme/Gym_Emu.cpp\nhttps://github.com/libgme/game-music-emu\n\n[-] About NotCVE:\nNotCVE (https://notcve.org) assigns public, timestamped NotCVE IDs to\nvulnerabilities not acknowledged by vendors. Vendor will not assign a CVE?\nRequest a NotCVE: https://notcve.org/form/ · Contributors:\nhttps://notcve.org/hall/\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives & RSS: https://seclists.org/fulldisclosure/"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-126",
"description": "CWE-126",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-02T04:57:33Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description",
"exploit"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/94"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Sep/94"
},
{
"url": "https://github.com/libgme/game-music-emu"
},
{
"url": "https://github.com/libgme/game-music-emu/issues/166"
},
{
"url": "https://github.com/netspacer1124"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://notcve.org"
},
{
"url": "https://notcve.org/form/"
},
{
"url": "https://notcve.org/hall/"
},
{
"url": "https://notcve.org/notcve/NotCVE-2026-0018"
},
{
"url": "https://raw.githubusercontent.com/libgme/game-music-emu/0.6.5/gme/Gym_Emu.cpp"
},
{
"url": "https://seclists.org/fulldisclosure/"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Sep/94"
],
"discovery": "EXTERNAL"
},
"title": "[NotCVE-2026-0018] game-music-emu (libgme) through 0.6.5 Unbounded GYM Command Loop Allows Heap Out-of-Bounds Read",
"x_gcve": [
{
"recordType": "advisory",
"relationships": [],
"vulnId": "GCVE-1988-2026-0422",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/94",
"automated": true,
"contentSha256": "3878efdb4d58d208a2366f5164763704bb97ed9449567c22ec0facdf3e2096b9",
"evidenceScore": 10,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/94",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-09-29T08:29:30Z"
}
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-10-02T04:57:33Z",
"dateUpdated": "2026-10-02T04:57:33Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0422"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}