EUVD-2026-110506

gbsplay through 0.0.103 contains an out-of-bounds read vulnerability in mappermap in mapper.c that fails to reject ROM bank indexes beyond the ROM size, causing an underflowed bank length. Attackers can supply crafted .gbr, .gbs or .gb files with malicious bank indexes to make bankget read far pa...

EUVD-2026-110475

gbsplay through 0.0.103 contains a heap out-of-bounds read vulnerability in vgmopen in gbs.c that walks the VGM command stream without bounds checks. Attackers can supply a crafted VGM file with wait opcodes and no 0x66 terminator to read past the heap buffer and crash the player...

EUVD-2026-110474

Gbsplay through 0.0.103 contains a heap out-of-bounds read vulnerability in gbropen in gbs.c that fails to verify file length before scanning the GBR ROM title field. Attackers can supply a crafted GBR file of 0x21 to 0x162 bytes to read past the heap buffer, crashing gbsplay or leaking memory...

CVE-2026-116727

The software gbsplay (versions through 0.0.103 ) is vulnerable to a heap out-of-bounds read in the vgm_open() function within gbs.c. The root cause is a lack of bounds checks while walking the VGM command stream . An attacker can provide a maliciously crafted VGM file containing wait opcodes with...

CVE-2026-116727 gbsplay through 0.0.103 Heap Out-of-Bounds Read via vgm_open in gbs.c

gbsplay through 0.0.103 contains a heap out-of-bounds read vulnerability in vgmopen in gbs.c that walks the VGM command stream without bounds checks. Attackers can supply a crafted VGM file with wait opcodes and no 0x66 terminator to read past the heap buffer and crash the player...

CVE-2026-116726

The gbsplay software (versions through 0.0.103 ) is vulnerable to a heap out-of-bounds read in the gbr_open() function located in gbs.c. The root cause is a failure to verify file length before scanning the GBR ROM title field . By providing a crafted GBR file between 0x21 and 0x162 bytes , an at...

CVE-2026-116726 gbsplay through 0.0.103 Heap Out-of-Bounds Read via gbr_open GBR Title

Gbsplay through 0.0.103 contains a heap out-of-bounds read vulnerability in gbropen in gbs.c that fails to verify file length before scanning the GBR ROM title field. Attackers can supply a crafted GBR file of 0x21 to 0x162 bytes to read past the heap buffer, crashing gbsplay or leaking memory...

CVE-2026-116725

The gbsplay emulator (versions through 0.0.103 ) is vulnerable to an out-of-bounds read in the mapper_map() function within mapper.c. The root cause is a failure to reject ROM bank indexes that exceed the ROM size, which leads to an underflowed bank length . An attacker can exploit this by provid...

CVE-2026-116725 gbsplay through 0.0.103 Out-of-Bounds Read via mapper_map ROM Bank Index

gbsplay through 0.0.103 contains an out-of-bounds read vulnerability in mappermap in mapper.c that fails to reject ROM bank indexes beyond the ROM size, causing an underflowed bank length. Attackers can supply crafted .gbr, .gbs or .gb files with malicious bank indexes to make bankget read far pa...