CVE-2026-116727 in gbsplay
Summary
by MITRE • 10/27/2026
gbsplay through 0.0.103 contains a heap out-of-bounds read vulnerability in vgm_open() in gbs.c that walks the VGM command stream without bounds checks. Attackers can supply a crafted VGM file with wait opcodes and no 0x66 terminator to read past the heap buffer and crash the player.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/27/2026
The software component known as gbsplay, specifically in version 0.0.103, contains a critical memory safety vulnerability classified under CWE-125, which denotes an out-of-bounds read. This flaw resides within the vgm_open function located in the source file gbs.c and is triggered during the processing of Video Game Music (VGM) command streams. The core technical deficiency lies in the absence of rigorous bounds checking when iterating through the VGM data structure. In a properly secured implementation, any parser traversing external or semi-trusted binary data must validate that every access point remains within the allocated memory boundaries to prevent reading sensitive information from adjacent heap regions or causing undefined behavior due to accessing unmapped memory pages.
The operational mechanism of this vulnerability involves the handling of specific VGM opcodes, particularly wait commands. When a crafted VGM file is supplied containing these wait operations but lacking the expected 0x66 terminator byte at the end of the stream, the parser continues its iteration beyond the intended buffer limit. Because the termination condition relies on finding this specific marker rather than verifying the current offset against the total size of the allocated heap buffer, the application proceeds to read memory locations that do not belong to the VGM data structure. This unchecked access results in a heap out-of-bounds read, where arbitrary bytes from the surrounding heap space are interpreted as part of the command stream.
The immediate impact of this vulnerability is typically a denial of service manifested by an application crash or segmentation fault. When the parser attempts to dereference memory addresses that have not been allocated for the buffer or fall outside valid mapping regions, the operating system interrupts execution to prevent further corruption. While the primary manifestation observed in initial reports is a crash, out-of-bounds reads can also lead to information disclosure if the attacker can control subsequent logic based on the leaked data values. This aligns with ATT&CK technique T1083, which covers File and Directory Discovery, as reading arbitrary heap memory could potentially expose internal state variables or pointers that aid in further exploitation attempts such as code execution via return-oriented programming techniques.
To mitigate this vulnerability, developers must implement strict boundary checks within the vgm_open function before processing any VGM opcode. The parser should calculate the remaining length of the buffer at each step and ensure that the next expected byte or sequence does not exceed the allocated size. Additionally, validating the presence of the 0x66 terminator as a hard constraint for stream termination is insufficient; instead, explicit length validation must govern all read operations. Updating to a patched version where these bounds checks are enforced will resolve the issue. For users unable to update immediately, input sanitization at the ingestion layer or disabling automatic playback of untrusted VGM files can reduce exposure until a permanent fix is deployed.