CVE-2026-61542

The Gearboy emulator and debugger is vulnerable in its Gearsystem component when using the optional --mcp-http mode. The underlying cause is that the platforms/shared/desktop/mcp/mcp_transport.h transport binds to INADDR_ANY (typically on port 7777) and fails to perform Authorization , Host , or ...

CVE-2026-61542 Gearboy advisory / Gearsystem body: Unauthenticated network exposure of MCP HTTP tools

Gearboy is a Game Boy, Game Boy Color, and Super Game Boy emulator and debugger with an embedded MCP server. Gearsystem, the affected component, has an optional --mcp-http mode that accepts unauthenticated MCP requests from any reachable network peer despite localhost-only documentation and...