CVE-2026-111152
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
Game Music Emu (libgme) through 0.6.5 contains a heap out-of-bounds read vulnerability in the AY loader get_data function caused by an integer underflow in the track-table bounds check. Attackers can supply a crafted ZXAYEMUL file with an oversized track table to read past the file buffer via gme_track_info or gme_start_track, crashing libgme consumers.
Risk Assessment
The vulnerability can lead to application crashes (denial of service) and potential memory data leakage. The risk affects applications using libgme to play untrusted ZXAYEMUL files.
Recommendation
Update libgme to a version newer than 0.6.5 if available, or avoid playing untrusted ZXAYEMUL files. Consider validating track table sizes before processing.
Other vulnerabilities in Game Music Emu (libgme)
Original NVD description (English source)
Game Music Emu (libgme) through 0.6.5 contains a heap out-of-bounds read vulnerability in the AY loader get_data function caused by an integer underflow in the track-table bounds check. Attackers can supply a crafted ZXAYEMUL file with an oversized track table to read past the file buffer via gme_track_info or gme_start_track, crashing libgme consumers.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS