{"id":"CVE-2026-116725","kind":"vulnerability","aliases":["CVE-2026-116725"],"related":[],"title":"gbsplay: crafted Game Boy file reads past heap buffer, crashes player","description":"gbsplay through 0.0.103 contains an out-of-bounds read vulnerability in mapper_map() in mapper.c that fails to reject ROM bank indexes beyond the ROM size, causing an underflowed bank length. Attackers can supply crafted .gbr, .gbs or .gb files with malicious bank indexes to make bank_get() read far past the heap ROM buffer and crash the player.","summary":"gbsplay, a command-line player for Game Boy sound files, has an out-of-bounds read in mapper_map() that accepts ROM bank indexes beyond the ROM size. A crafted .gbr, .gbs or .gb file makes the player read far past its heap ROM buffer and crash.","severity":"medium","cvss":6.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["gbsplay","linux","package","retro-audio"],"not_affected_if":["gbsplay-not-installed","no-untrusted-files"],"how_to_check":"- Run `gbsplay --version` and compare against the version range through 0.0.103 in the NVD entry\n- Check whether the gbsplay binary or package is installed on the machine with `which gbsplay`","fix":"- unknown","status":"open","published_at":"2026-10-26T22:16:56+00:00","first_seen_at":"2026-10-26T22:25:33+00:00","triaged_at":"2026-10-26T22:27:56+00:00","updated_at":"2026-10-26T22:27:56+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-26T22:27:56Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"local","title":"gbsplay: crafted Game Boy file reads past heap buffer, crashes player","impact":"low","summary":"gbsplay, a command-line player for Game Boy sound files, has an out-of-bounds read in mapper_map() that accepts ROM bank indexes beyond the ROM size. A crafted .gbr, .gbs or .gb file makes the player read far past its heap ROM buffer and crash.","category":"package","nicknames":[],"who_cares":["gbsplay","retro-audio","linux"],"confidence":0.6,"needs_auth":"no","worst_case":"Player crashes; memory disclosure or code execution not stated in sources.","analyst_note":"Check the upstream gbsplay repository for a fixed release after 0.0.103 and whether the sources support any impact beyond a crash.","how_to_check":"- Run `gbsplay --version` and compare against the version range through 0.0.103 in the NVD entry\n- Check whether the gbsplay binary or package is installed on the machine with `which gbsplay`","needs_analyst":true,"not_affected_if":["no-untrusted-files","gbsplay-not-installed"],"who_is_affected":"Anyone who opens untrusted .gbr, .gbs or .gb files with gbsplay, whether directly or through a script or service that feeds it files. The sources describe a crash rather than code execution, and do not say whether a patched release exists. Systems that never run gbsplay on outside files can skip it.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.000612,"input_tokens":3361,"output_tokens":551,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116725':14A,17A '-2026':13A,16A '0.0.103':75C 'accept':46B 'attack':105C 'audio':23B 'bank':48B,94C,103C,116C,120C 'beyond':50B,96C 'bound':40B,81C 'boy':4A,32B 'buffer':9A,70B,128C 'caus':100C 'command':27B 'command-lin':26B 'contain':76C 'craft':2A,55B,108C 'crash':10A,72B,130C 'cve':12A,15A 'fail':90C 'far':65B,123C 'file':5A,34B,60B,113C 'game':3A,31B 'gb':59B,112C 'gbr':56B,109C 'gbs':57B,110C 'gbsplay':1A,18B,24B,73C 'get':121C 'heap':8A,68B,126C 'index':49B,95C,117C 'length':104C 'line':28B 'linux':19B 'make':61B,119C 'malici':115C 'map':44B,86C 'mapper':43B,85C 'mapper.c':88C 'out-of-bound':37B,78C 'packag':20B 'past':7A,66B,124C 'player':11A,29B,63B,132C 'read':6A,41B,64B,82C,122C 'reject':92C 'retro':22B 'retro-audio':21B 'rom':47B,52B,69B,93C,98C,127C 'size':53B,99C 'sound':33B 'suppli':107C 'underflow':102C 'vulner':83C","nicknames":[],"mitigations":[],"who_affected":"Anyone who opens untrusted .gbr, .gbs or .gb files with gbsplay, whether directly or through a script or service that feeds it files. The sources describe a crash rather than code execution, and do not say whether a patched release exists. Systems that never run gbsplay on outside files can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T22:16:56+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116725","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116725","severity":null,"published_at":"2026-10-26T22:16:56+00:00","modified_at":"2026-10-26T22:16:56+00:00","first_seen_at":"2026-10-26T22:25:33+00:00","fetched_at":"2026-10-26T22:25:33+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}