CVE-2026-116727— gbsplay through 0.0.103 Heap Out-of-Bounds Read via vgm_open in gbs.c

Quick assessment

Affected

mmitch gbsplay

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

gbsplay 0.0.103 及更早版本在 gbs.c 的 vgm_open() 函数中存在堆越界读取漏洞。该函数在遍历 VGM 命令流时未进行边界检查。攻击者可构造一个包含等待操作码（wait opcodes）且缺少 0x66 终止符的 VGM 文件，从而读取堆缓冲区之外的数据并导致播放器崩溃。

CVSS 3.3 · Low Updated Oct 27, 2026

Possible ATT&CK Techniques 2 AI

T1566.001 · Spearphishing Attachment T1203 · Exploitation for Client Execution

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

gbsplay through 0.0.103 Heap Out-of-Bounds Read via vgm_open in gbs.c

Source: CVE Program / CVE List V5

Vulnerability Description

gbsplay through 0.0.103 contains a heap out-of-bounds read vulnerability in vgm_open() in gbs.c that walks the VGM command stream without bounds checks. Attackers can supply a crafted VGM file with wait opcodes and no 0x66 terminator to read past the heap buffer and crash the player.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

Source: CVE Program / CVE List V5

Vulnerability Type

跨界内存读

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
mmitch	gbsplay	0 ~ 0.0.103	-

II. Public POCs for CVE-2026-116727

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-116727

请登录查看更多情报信息。

Other References for CVE-2026-116727 (6)

https://github.com/mmitch/gbsplay product
https://github.com/mmitch/gbsplay/blob/0.0.103/gbs.c#L996-L1010 technical-description
https://github.com/mmitch/gbsplay/commit/91b1f6df0abd3914f91caa528ec3213d731999e8 patch
https://hackmd.io/@haindpwn/gbsplay-rom-bank-index-oob-read third-party-advisory
https://github.com/mmitch/gbsplay/issues/201 issue-tracking
https://www.vulncheck.com/advisories/gbsplay-through-0.0.103-heap-out-of-bounds-read-via-vgm-open-in-gbs-c third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-116727

Same Patch Batch · mmitch · 2026-10-26 · 3 CVEs total

CVE-2026-116725	5.5 MEDIUM	gbsplay through 0.0.103 Out-of-Bounds Read via mapper_map ROM Bank Index
CVE-2026-116726	3.3 LOW	gbsplay through 0.0.103 Heap Out-of-Bounds Read via gbr_open GBR Title

IV. Related Vulnerabilities

Same product: gbsplay

Same vendor: mmitch

Same weakness: CWE-125