Out-of-Bounds Read Vulnerability in Game Music Emu by Libgme
CVE-2026-111153

6.8MEDIUM

Key Information:

Vendor: Libgme
Status: Game-music-emu
Vendor: CVE Published:; 15 October 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-111153?

Game Music Emu (libgme) versions prior to 0.6.5 are prone to a global out-of-bounds read vulnerability within the Classic_Emu::mute_voices_ method. This flaw enables attackers to induce application crashes by supplying crafted NSF files with a voice count exceeding the predefined 16-entry voice-type table. When exploited, an attacker can create an NSF header with chip_flags set to 0x3F, which can be opened using gme_open_data or gme_open_file. This manipulation allows reading beyond a static array during the loading process, ultimately leading to denial of service.

Affected Version(s)

game-music-emu 0 <= 0.6.5

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-111153 - Proof of Concept