EUVD-2026-102275Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft PSID/RSID file with oversized data offset
-
ExploitVictim opens tune in libsidplayfp app
-
ImpactOOB read in resolveAddrs() crashes application
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an attacker to supply a crafted PSID/RSID SID tune file in which the header data offset is set beyond the actual file size, and requires a victim to load/play that file in an application using libsidplayfp version 3.1.1 or earlier. Per the CVSS vector this is a local vector with passive user interaction (UI:P) and no authentication (PR:N) - no special product configuration or feature toggle is needed; any application that parses attacker-supplied tunes via SidTuneBase::acceptSidTune is affected. Limiting factors: exploitation cannot occur without user interaction (opening the malicious file), there is no network-reachable path, and the confirmed impact is limited to an application crash (DoS) with no code execution or verified data exposure. |
| Impact | This is a moderate, not high-priority, issue. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H) and score of 6.8 describe a local, user-interaction-dependent denial-of-service: the attacker cannot reach the code remotely and must get a victim to open a crafted SID tune. Crucially, the only rated impact is availability (VA:H); confidentiality and integrity are N, meaning the vendor/NVD assessment treats this as a crash, not a data leak or code-execution bug - even though CWE-125 and the 'Information Disclosure' tag imply memory disclosure. This is a notable conflict: an out-of-bounds READ is classically a disclosure primitive, but the description and CVSS both frame the outcome purely as an application crash, so there is no evidence the 64 KiB of over-read data is ever returned to the attacker. Publicly available exploit code exists (POC via hackmd write-up and VulnCheck advisory), which raises practical risk, but there is no CISA KEV listing and no EPSS score was provided, so there is no indication of widespread or automated exploitation. No SSVC decision data was supplied. Net: real but low-urgency - a reliable DoS against a niche media library, worth patching but not an emergency. |
| Exploit ScenarioDerived | An attacker distributes a malicious .sid (PSID/RSID) tune - e.g., via a music archive, download, or chat - whose header data offset is set beyond the file size. When a victim opens or plays the file in an application built on libsidplayfp ≤3.1.1, the wrapped length calculation causes resolveAddrs() to read up to 64 KiB past the heap buffer, crashing the application. A public proof-of-concept and technical write-up already exist, lowering the barrier to reproduction. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 15, 2026
Loading a crafted PSID/RSID SID tune file in applications built on libsidplayfp through 3.1.1 crashes the process through a heap out-of-bounds read. The library trusts the header's data offset without validating it against the real file size, so an attacker-supplied offset wraps the length calculation in SidTuneBase::resolveAddrs() and the code reads up to 64 KiB past the heap buffer. The confirmed impact is denial of service only - no code execution and no verified data exposure - and an attacker must get a victim to open or play the malicious tune, so this is a moderate, not high-priority, issue; publicly available exploit code exists (a HackMD write-up), but there is no confirmed active exploitation (not in CISA KEV).
RemediationAI
Patch status: No vendor-released patch identified in the available data at time of analysis - the description only bounds the affected range at 'through 3.1.1', so administrators should monitor the upstream repository (https://github.com/libsidplayfp/libsidplayfp) and the VulnCheck advisory (https://www.vulncheck.com/advisories/libsidplayfp-through-3.1.1-heap-out-of-bounds-read-via-sidtunebase-acceptsidtune) for a fixed release and upgrade as soon as one is tagged; the code references at commit 732fa8ec (SidTuneBase.cpp lines 295-300 and 488-500) show the parsing paths that need the missing bounds check and are useful for verifying whether a given build already contains the fix. Until then, the most effective compensating control is to refuse untrusted tunes: if you control the calling application, validate the PSID/RSID header before handing it to the library - reject files where the declared data offset (or any computed payload length) is greater than or equal to the real file size, and cap accepted file sizes - which costs nothing functionally but requires code changes on your side. Operational mitigations include opening .sid files only from trusted sources and never batch-processing untrusted tune archives on systems where a crash causes a service outage, and running SID players under an unprivileged account inside a sandbox, container or VM (seccomp/AppArmor or equivalent) so that an out-of-bounds read-and-crash cannot escalate; note the trade-off that sandboxing can interfere with audio devices, plugin loading and desktop integration. Because the confirmed impact is only a crash, no memory-corruption hardening beyond these steps is strictly required, and the public PoC write-up (https://hackmd.io/@haind-pwn/libsidplayfp-psid-dataoffset-underflow-oob-read) can be used to build a regression test once a patched build is available.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
libsidplayfp is a portable C++ reimplementation of the SID chip playback engine used by players, emulators and command-line tools to render Commodore 64 PSID/RSID tune files. The PSID/RSID container is a header followed by a C64 binary blob, and the header carries a big-endian data offset (and related addresses/lengths) that tells the library where the payload starts and how long it is. CWE-125 (out-of-bounds read) applies here because the code in SidTuneBase.cpp (see the referenced lines 295-300 and 488-500 at commit 732fa8ec) computes a payload length from that attacker-controlled offset without ensuring the offset is inside the file; when the declared offset exceeds the actual file size, the subtraction wraps, and resolveAddrs() subsequently walks addresses out of a heap buffer that was sized from the wrapped value, producing reads up to roughly 64 KiB past the allocation. The affected component is the library itself (CPE cpe:2.3:a:libsidplayfp:libsidplayfp), so every downstream application that calls SidTuneBase::acceptSidTune on untrusted tune files inherits the bug. The supplied CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P, all environmental/temporal metrics 'X') is consistent with a local, no-authentication crash reachable only through file handling, and the independent assessment (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) confirms availability-only impact with no demonstrated confidentiality or integrity loss.
Know when Libsidplayfp gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Attacker supplies a file the victim must open (AV:L, UI:R); parsing deterministically triggers the OOB read (AC:L, PR:N); confirmed impact is a crash only, so C:N/I:N/A:H.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
libsidplayfp through 3.1.1 contains a heap out-of-bounds read vulnerability that allows attackers to crash applications by supplying a PSID/RSID file with an unchecked data offset. Attackers can set the header data offset beyond the file size, wrapping the length calculation so resolveAddrs() reads up to 64 KiB past the heap buffer.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB