Game Music Emu CVE-2026-111153

Exploitation requires a victim application to open an attacker-supplied NSF file through libgme's gme_open_data or gme_open_file entry points; the malicious trigger is an NSF header whose chip_flags value (e.g. 0x3F) implies a voice count exceeding the fixed 16-entry voice-type table, causing the out-of-bounds read in Classic_Emu::mute_voices_ during loading. Limiting factors: this is a local, file-based vector (AV:L) that depends on user interaction (UI:P) - the attacker cannot trigger it without the victim loading the crafted file - and only applies to applications linking libgme versions through 0.6.5 that process untrusted NSF input. Impact is confined to a crash (availability); no code execution, data disclosure, or privilege gain is indicated.

This is a medium-severity denial-of-service issue, not a top-tier priority, and the signals are largely consistent. The input CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H) scores 6.8 and correctly reflects a local, file-parsing bug: the attacker does not deliver packets over a network but instead supplies a malicious NSF file that a victim (or an application processing untrusted input) must open, hence the passive user-interaction requirement and availability-only impact. A public POC/writeup exists (hackmd analysis by VulnCheck), which raises practical exploitability, but there is no CISA KEV listing and no EPSS score was provided, so there is no evidence of active or widespread exploitation - the exploit code demonstrates a crash, not remote code execution. The impact ceiling is low: CWE-125 out-of-bounds READ affecting only availability (a crash during loading), with no confidentiality or integrity impact per the vector. Note one tension worth flagging: the Tags list includes 'Information Disclosure', but both the description (crash/DoS only) and the CVSS metrics (VC:N/VI:N) indicate no data is exfiltrated - treat information disclosure as unconfirmed/theoretical for this global OOB read. Overall this is a real but modest bug: easy to trigger with a crafted file, but limited to crashing the consuming application.

An attacker crafts a malicious NSF chiptune file with an invalid header (chip_flags set to 0x3F, implying a voice count beyond the 16-entry voice-type table) and distributes it via a download, chat, or media library. When a victim's media player or emulator built on libgme loads the file through gme_open_data or gme_open_file, Classic_Emu::mute_voices_ reads past a static array and crashes the application. A public proof-of-concept and technical writeup already demonstrate the out-of-bounds read.