Heap Out-of-Bounds Read in Game Music Emu AY Loader
CVE-2026-111152

6.8MEDIUM

Key Information:

Vendor

Libgme

Status
Game-music-emu
Vendor
CVE Published:
15 October 2026

Badges

👾 Exploit Exists

What is CVE-2026-111152?

Game Music Emu (libgme) version 0.6.5 is susceptible to a heap out-of-bounds read due to an integer underflow in the AY loader’s get_data function. This flaw allows attackers to craft a ZXAYEMUL file featuring an oversized track table, enabling them to read beyond the intended file buffer. As a result, this can lead to crashes for libgme consumers when calling gme_track_info or gme_start_track.

Affected Version(s)

game-music-emu 0 <= 0.6.5

References

https://hackmd.io/@haind-pwn/libgme-ay-track-table-underf...
technical-descriptionexploit
https://github.com/libgme/game-music-emu/blob/9e23d10f9fd...
technical-description
https://github.com/libgme/game-music-emu/commit/ae10a8f05...
patch

CVSS V4

Score:
6.8
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

HaiND from the Post and Telecommunication Institute of Technology
.