Out-of-Bounds Read Vulnerability in gbsplay by mmitch
CVE-2026-116725

6.8MEDIUM

Key Information:

Vendor

Mmitch

Status
Gbsplay
Vendor
CVE Published:
26 October 2026

What is CVE-2026-116725?

The gbsplay software up to version 0.0.103 is susceptible to an out-of-bounds read vulnerability stemming from improper handling of ROM bank indexes in the mapper_map() function found in mapper.c. This flaw allows attackers to submit carefully crafted .gbr, .gbs, or .gb files that contain malicious bank indexes. As a result, the bank_get() function may read beyond the allocated heap ROM buffer, potentially leading to crashes of the application. This vulnerability has raised security concerns regarding the integrity and functionality of the gbsplay player.

Affected Version(s)

gbsplay 0 <= 0.0.103

References

https://github.com/mmitch/gbsplay/issues/201
issue-tracking
https://github.com/mmitch/gbsplay
product
https://github.com/mmitch/gbsplay/commit/a281d80bc56ed633...
patch

CVSS V4

Score:
6.8
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

HaiND from the Post and Telecommunication Institute of Technology
.