---
id: "CVE-2026-116725"
kind: "vulnerability"
aliases: ["CVE-2026-116725"]
title: "gbsplay: crafted Game Boy file reads past heap buffer, crashes player"
severity: "medium"
cvss: 6.8
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["gbsplay", "linux", "package", "retro-audio"]
not_affected_if: ["gbsplay-not-installed", "no-untrusted-files"]
published_at: "2026-10-26T22:16:56+00:00"
first_seen_at: "2026-10-26T22:25:33+00:00"
updated_at: "2026-10-26T22:27:56+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116725", "first_seen_at": "2026-10-26T22:25:33+00:00"}]
---

# gbsplay: crafted Game Boy file reads past heap buffer, crashes player

gbsplay, a command-line player for Game Boy sound files, has an out-of-bounds read in mapper_map() that accepts ROM bank indexes beyond the ROM size. A crafted .gbr, .gbs or .gb file makes the player read far past its heap ROM buffer and crash.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `gbsplay --version` and compare against the version range through 0.0.103 in the NVD entry
- Check whether the gbsplay binary or package is installed on the machine with `which gbsplay`

## Fix

- unknown

## Timeline

- 2026-10-26T22:25:33+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116725

## From the sources

gbsplay through 0.0.103 contains an out-of-bounds read vulnerability in mapper_map() in mapper.c that fails to reject ROM bank indexes beyond the ROM size, causing an underflowed bank length. Attackers can supply crafted .gbr, .gbs or .gb files with malicious bank indexes to make bank_get() read far past the heap ROM buffer and crash the player.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_