Live › vulnerability › CVE-2026-116727
Go to dashboardgbsplay, a Game Boy sound player, has a heap out-of-bounds read in vgm_open() in gbs.c because it walks the VGM command stream without bounds checks. A crafted VGM file with wait opcodes and no 0x66 terminator makes the player read past its heap buffer and crash.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 22:25 UTC. All times on this page are UTC.
Only installations of gbsplay through that open VGM files are affected, and the reported impact is a crash of the player. Systems that do not run gbsplay or never process untrusted VGM files can skip it.
0.0.103No product ranges from the sources yet.
gbsplay --version and compare against the fixed release; the sources say the flaw affects versions through 0.0.1030.0.103 once a fixed release is available; unknown for the exact fixed versionEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
gbsplay through 0.0.103 contains a heap out-of-bounds read vulnerability in vgm_open() in gbs.c that walks the VGM command stream without bounds checks. Attackers can supply a crafted VGM file with wait opcodes and no 0x66 terminator to read past the heap buffer and crash the player.
This page as .md · .json · in your agent: get_signal("CVE-2026-116727")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.