drhelius Gearboy up to 3.8.6 Gearsystem mcp_transport.h improper authentication

Summaryinfo

A vulnerability described as critical has been identified in drhelius Gearboy up to 3.8.6. Impacted is an unknown function of the file platforms/shared/desktop/mcp/mcp_transport.h of the component Gearsystem. The manipulation results in improper authentication. This vulnerability is reported as CVE-2026-61542. The attack can be launched remotely. No exploit exists. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability classified as critical has been found in drhelius Gearboy up to 3.8.6. Affected is an unknown code block of the file platforms/shared/desktop/mcp/mcp_transport.h of the component Gearsystem. The manipulation with an unknown input leads to a improper authentication vulnerability. CWE is classifying the issue as CWE-287. When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

Gearboy is a Game Boy, Game Boy Color, and Super Game Boy emulator and debugger with an embedded MCP server. Gearsystem, the affected component, has an optional `--mcp-http` mode that accepts unauthenticated MCP requests from any reachable network peer despite localhost-only documentation and logging. In the described `platforms/shared/desktop/mcp/mcp_transport.h` transport, the socket binds `INADDR_ANY`, normally on port 7777, and POST requests to `/mcp` reach dispatch without `Authorization`, `Host`, or `Origin` checks. Responses and OPTIONS advertise `Access-Control-Allow-Origin: *`. A peer can initialize an MCP session and invoke exposed emulator/debugging operations; even a garbage bearer token does not block dispatch, while a loopback-bind negative control prevents network access. The reported impact is bounded to the emulator process, debugging state, and local files accepted as media, rather than demonstrated host code execution. Gearboy 3.8.7 contains a patch.

The advisory is available at github.com. This vulnerability is traded as CVE-2026-61542 since 07/10/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Technical details are known, but there is no available exploit.

Upgrading to version 3.8.7 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• drhelius

Name

• Gearboy

Version

• 3.8.0
• 3.8.1
• 3.8.2
• 3.8.3
• 3.8.4
• 3.8.5
• 3.8.6

Website

• Product: https://github.com/drhelius/Gearboy/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion