Live › vulnerability › CVE-2026-116726
Go to dashboardGbsplay through 0.0.103 fails to check file length in gbr_open() before scanning the GBR ROM title field. A crafted GBR file of 0x21 to 0x162 bytes can make it read past a heap buffer, crashing the player or leaking memory.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 22:25 UTC. All times on this page are UTC.
Systems that run gbsplay on untrusted GBR files, such as a player that opens files downloaded from others. Using gbsplay only on files you created or trust is low risk. The sources do not say whether a fixed version exists.
No product ranges from the sources yet.
gbsplay --version and compare against 0.0.103.which gbsplay.Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Gbsplay through 0.0.103 contains a heap out-of-bounds read vulnerability in gbr_open() in gbs.c that fails to verify file length before scanning the GBR ROM title field. Attackers can supply a crafted GBR file of 0x21 to 0x162 bytes to read past the heap buffer, crashing gbsplay or leaking memory.
This page as .md · .json · in your agent: get_signal("CVE-2026-116726")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.