CVE-2026-116725

Name of the Vulnerable Software and Affected Versions gbsplay versions 0.0.1 through 0.0.103

Description An out-of-bounds read occurs in the mapper map() function within mapper.c because the software fails to reject ROM bank indexes that exceed the ROM size, leading to an underflowed bank length. An attacker can provide specially crafted .gbr, .gbs, or .gb files containing malicious bank indexes to force the bank get() function to read beyond the heap ROM buffer, resulting in a player crash.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.