CVE-2026-116727

Name of the Vulnerable Software and Affected Versions gbsplay versions 0.0.1 through 0.0.103

Description A heap out-of-bounds read occurs in the vgm open() function within gbs.c because the VGM command stream is processed without proper bounds checks. An attacker can cause the player to crash by providing a specially crafted VGM file containing wait opcodes and lacking a 0x66 terminator, which forces the application to read beyond the allocated heap buffer.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.