Description (en)
----------------------------------------------------------------------------
NotCVE Advisory — NotCVE-2026-0019
----------------------------------------------------------------------------
[-] Summary:
An out-of-bounds read in the VGM command interpreter of game-music-emu
(libgme), the open-source video game music emulation library, allows an
attacker who supplies a crafted .vgm or .vgz file to read heap memory past
the end of the buffer holding the file. The read happens as soon as
playback begins. CVSS:3.1 5.4 (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L).
[-] Affected:
game-music-emu (libgme) through 0.6.5 (present in 0.6.0, 0.6.3 and 0.6.5),
and master as of commit fe8da4b. Default builds; no fixed version is
verified.
[-] Technical Description:
The command loop of Vgm_Emu_Impl::run_commands() (gme/Vgm_Emu_Impl.cpp) is
bounded only by
while ( vgm_time < end_time && pos < data_end )
which validates the position of the opcode byte and nothing else. Each
opcode handler then fetches its operands from pos unconditionally. The
source records the gap in a TODO at the loop head: "be sure there are
enough bytes left in stream for particular command so we don't read past
end".
When a command stream ends right after an opcode byte, the operand fetch
crosses the end of the allocation made by Gme_File::load_(). Maximum
over-read per handler:
- PSG and Game Gear register writes (*pos++): 1 byte
- 16-bit delay 0x61 (pos[0], pos[1]): up to 2 bytes
- YM2413 and YM2612 register writes: up to 2 bytes
- PCM seek 0xE0 (pos[0] .. pos[3]): up to 4 bytes
- data block header 0x67 (pos[1], get_le32( pos + 2 )): up to 6 bytes
The bytes read are consumed as sound-chip register data, so adjacent heap
contents can influence the decoded audio (limited, indirect disclosure).
AddressSanitizer aborts on the over-read; the researcher's two
proof-of-concept files reproduce it at two sites (a trailing 0x50 PSG
write and a trailing 0x67 data block header). Under a standard allocator a
read of this size normally stays within the same chunk, so a crash is
layout-dependent rather than reliable. No write, length control or code
execution is shown.
Reachability: VGM/VGZ support is in the default build. FFmpeg's
libavformat/libgme.c calls gme_open_data() and then gme_start_track()
inside read_header_gme(), so a server-side transcoder reaches the defect
while merely reading a file's header. VLC exposes the library through its
gme demux module, which handles VGM and VGZ.
Weaknesses:
CWE-125: Out-of-bounds Read
CWE-126: Buffer Over-read
CAPEC-540: Overread Buffers
[-] Credit:
Discovered by netspacer1124 (https://github.com/netspacer1124).
[-] Full Details and Updates:
https://notcve.org/notcve/NotCVE-2026-0019
[-] Main References:
https://github.com/libgme/game-music-emu
https://raw.githubusercontent.com/libgme/game-music-emu/0.6.5/gme/Vgm_Emu_Impl.cpp
https://ffmpeg.org/doxygen/5.1/libgme_8c_source.html
[-] About NotCVE:
NotCVE (https://notcve.org) assigns public, timestamped NotCVE IDs to
vulnerabilities not acknowledged by vendors. Vendor will not assign a CVE?
Request a NotCVE: https://notcve.org/form/ · Contributors:
https://notcve.org/hall/
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/
Raw JSON
{
"containers": {
"cna": {
"affected": [
{
"product": "Game Music Emu",
"vendor": "Game Music Emu Project",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "advisories"
}
],
"descriptions": [
{
"lang": "en",
"value": "----------------------------------------------------------------------------\nNotCVE Advisory — NotCVE-2026-0019\n----------------------------------------------------------------------------\n\n[-] Summary:\nAn out-of-bounds read in the VGM command interpreter of game-music-emu\n(libgme), the open-source video game music emulation library, allows an\nattacker who supplies a crafted .vgm or .vgz file to read heap memory past\nthe end of the buffer holding the file. The read happens as soon as\nplayback begins. CVSS:3.1 5.4 (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L).\n\n[-] Affected:\ngame-music-emu (libgme) through 0.6.5 (present in 0.6.0, 0.6.3 and 0.6.5),\nand master as of commit fe8da4b. Default builds; no fixed version is\nverified.\n\n[-] Technical Description:\nThe command loop of Vgm_Emu_Impl::run_commands() (gme/Vgm_Emu_Impl.cpp) is\nbounded only by\n\n while ( vgm_time < end_time && pos < data_end )\n\nwhich validates the position of the opcode byte and nothing else. Each\nopcode handler then fetches its operands from pos unconditionally. The\nsource records the gap in a TODO at the loop head: \"be sure there are\nenough bytes left in stream for particular command so we don't read past\nend\".\n\nWhen a command stream ends right after an opcode byte, the operand fetch\ncrosses the end of the allocation made by Gme_File::load_(). Maximum\nover-read per handler:\n\n - PSG and Game Gear register writes (*pos++): 1 byte\n - 16-bit delay 0x61 (pos[0], pos[1]): up to 2 bytes\n - YM2413 and YM2612 register writes: up to 2 bytes\n - PCM seek 0xE0 (pos[0] .. pos[3]): up to 4 bytes\n - data block header 0x67 (pos[1], get_le32( pos + 2 )): up to 6 bytes\n\nThe bytes read are consumed as sound-chip register data, so adjacent heap\ncontents can influence the decoded audio (limited, indirect disclosure).\nAddressSanitizer aborts on the over-read; the researcher's two\nproof-of-concept files reproduce it at two sites (a trailing 0x50 PSG\nwrite and a trailing 0x67 data block header). Under a standard allocator a\nread of this size normally stays within the same chunk, so a crash is\nlayout-dependent rather than reliable. No write, length control or code\nexecution is shown.\n\nReachability: VGM/VGZ support is in the default build. FFmpeg's\nlibavformat/libgme.c calls gme_open_data() and then gme_start_track()\ninside read_header_gme(), so a server-side transcoder reaches the defect\nwhile merely reading a file's header. VLC exposes the library through its\ngme demux module, which handles VGM and VGZ.\n\nWeaknesses:\nCWE-125: Out-of-bounds Read\nCWE-126: Buffer Over-read\nCAPEC-540: Overread Buffers\n\n[-] Credit:\nDiscovered by netspacer1124 (https://github.com/netspacer1124).\n\n[-] Full Details and Updates:\nhttps://notcve.org/notcve/NotCVE-2026-0019\n\n[-] Main References:\nhttps://github.com/libgme/game-music-emu\nhttps://raw.githubusercontent.com/libgme/game-music-emu/0.6.5/gme/Vgm_Emu_Impl.cpp\nhttps://ffmpeg.org/doxygen/5.1/libgme_8c_source.html\n\n[-] About NotCVE:\nNotCVE (https://notcve.org) assigns public, timestamped NotCVE IDs to\nvulnerabilities not acknowledged by vendors. Vendor will not assign a CVE?\nRequest a NotCVE: https://notcve.org/form/ · Contributors:\nhttps://notcve.org/hall/\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives & RSS: https://seclists.org/fulldisclosure/"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-126",
"description": "CWE-126",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-02T04:57:33Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description",
"exploit"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/95"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Sep/95"
},
{
"url": "https://ffmpeg.org/doxygen/5.1/libgme_8c_source.html"
},
{
"url": "https://github.com/libgme/game-music-emu"
},
{
"url": "https://github.com/netspacer1124"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://notcve.org"
},
{
"url": "https://notcve.org/form/"
},
{
"url": "https://notcve.org/hall/"
},
{
"url": "https://notcve.org/notcve/NotCVE-2026-0019"
},
{
"url": "https://raw.githubusercontent.com/libgme/game-music-emu/0.6.5/gme/Vgm_Emu_Impl.cpp"
},
{
"url": "https://seclists.org/fulldisclosure/"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Sep/95"
],
"discovery": "EXTERNAL"
},
"title": "[NotCVE-2026-0019] game-music-emu through 0.6.5 VGM Command Interpreter Missing Operand Length Check Allows Heap Out-of-Bounds Read",
"x_gcve": [
{
"recordType": "advisory",
"relationships": [],
"vulnId": "GCVE-1988-2026-0423",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/95",
"automated": true,
"contentSha256": "98db2aa0360d4b5883a4049270315097b495f538dac159416177946e491b2bcc",
"evidenceScore": 10,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/95",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-09-29T08:31:36Z"
}
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-10-02T04:57:33Z",
"dateUpdated": "2026-10-02T04:57:33Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0423"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}