CVE-2026-116725— gbsplay through 0.0.103 Out-of-Bounds Read via mapper_map ROM Bank Index

Quick assessment

Affected

mmitch gbsplay

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

gbsplay 0.0.103 及更早版本在 mapper.c 的 mapper_map() 函数中存在越界读取漏洞。该函数未能拒绝超出 ROM 大小的 ROM 银行索引，导致银行长度发生下溢。攻击者可构造包含恶意银行索引的 .gbr、.gbs 或 .gb 文件，诱使 bank_get() 函数读取堆上 ROM 缓冲区远端的数据，从而导致播放器崩溃。

CVSS 5.5 · Medium Updated Oct 27, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

gbsplay through 0.0.103 Out-of-Bounds Read via mapper_map ROM Bank Index

Source: CVE Program / CVE List V5

Vulnerability Description

gbsplay through 0.0.103 contains an out-of-bounds read vulnerability in mapper_map() in mapper.c that fails to reject ROM bank indexes beyond the ROM size, causing an underflowed bank length. Attackers can supply crafted .gbr, .gbs or .gb files with malicious bank indexes to make bank_get() read far past the heap ROM buffer and crash the player.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

跨界内存读

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
mmitch	gbsplay	0 ~ 0.0.103	-

II. Public POCs for CVE-2026-116725

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-116725

请登录查看更多情报信息。

Other References for CVE-2026-116725 (6)

https://github.com/mmitch/gbsplay product
https://github.com/mmitch/gbsplay/blob/0.0.103/mapper.c#L71-L103 technical-description
https://github.com/mmitch/gbsplay/commit/a281d80bc56ed63347daf740a2f7aa4f8516165a patch
https://hackmd.io/@haindpwn/gbsplay-rom-bank-index-oob-read third-party-advisory
https://github.com/mmitch/gbsplay/issues/201 issue-tracking
https://www.vulncheck.com/advisories/gbsplay-through-0.0.103-out-of-bounds-read-via-mapper-map-rom-bank-index third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-116725

Same Patch Batch · mmitch · 2026-10-26 · 3 CVEs total

CVE-2026-116726	3.3 LOW	gbsplay through 0.0.103 Heap Out-of-Bounds Read via gbr_open GBR Title
CVE-2026-116727	3.3 LOW	gbsplay through 0.0.103 Heap Out-of-Bounds Read via vgm_open in gbs.c

IV. Related Vulnerabilities

Same product: gbsplay

Same vendor: mmitch

Same weakness: CWE-125