libgme CVE-2026-111152

Exploitation requires that the target application link libgme (Game Music Emu) version 0.6.5 or earlier AND that it parse an attacker-supplied ZXAYEMUL (AY-format) file by calling gme_track_info or gme_start_track. The crafted file must contain an oversized track-table count that underflows the file_size - 2 bounds check in Ay_Emu.cpp get_data. Limiting factors: the attack is LOCAL (AV:L) - the malicious file must reach the victim's machine - and requires passive user interaction (UI:P), i.e. the victim must open/process the file; there is no network-remote or unauthenticated-service exposure, and the impact is confined to crashing the consuming process rather than code execution or confirmed data disclosure.

This is a moderate, low-urgency issue despite being backed by multiple corroborating sources. The authoritative CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P, score 6.8) shows the defining constraints: exploitation is LOCAL and requires PASSIVE user interaction (UI:P) - a victim must open or process a crafted ZXAYEMUL file. The only impact is availability (VA:H / VC:N / VI:N): a heap out-of-bounds read that crashes libgme consumers, i.e. a denial-of-service, not code execution or data theft. A public exploit (the hackmd write-up by VulnCheck) and a vendor patch both exist, and the root cause is independently confirmable from the GitHub commit diff (an integer-underflow in the file_size - 2 bounds check, fixed by replacing an assert with an explicit guard). It is NOT in CISA KEV and no EPSS score was provided, so there is no evidence of active or widespread exploitation - consistent with a file-parsing DoS in a specialized library rather than a mass-exploitation target. Note one tension to flag: the Tags include 'Information Disclosure' and the bug is an out-of-bounds READ (which can in principle leak adjacent heap memory), yet the authoritative CVSS marks confidentiality VC:N - treat the demonstrated impact as a crash/DoS and verify any memory-disclosure claim against the VulnCheck advisory before relying on it.

An attacker crafts a malicious ZXAYEMUL (.ay) chiptune file whose track table declares an oversized count, then distributes it so a victim opens it in a media player, emulator, or thumbnailer that links libgme. When the application calls gme_track_info or gme_start_track, the underflowed bounds check lets get_data read past the file buffer and crash the process. Public exploit/write-up material is available from VulnCheck demonstrating the out-of-bounds read.