gbsplay CVE-2026-116727

Exploitation requires the victim to open/play an attacker-supplied crafted VGM file in gbsplay (≤0.0.103) - the vector is local (AV:L) and mandates user interaction (UI:P), so there is no remote or unattended trigger. The specific trigger is a VGM command stream containing wait opcodes with the 0x66 end-of-data terminator absent, which makes the unbounded loop in vgm_open() read past the heap buffer. No special configuration is needed beyond running an affected build and the standard VGM-playback code path. Limiting factors: the attack only works against vulnerable versions, delivers a crash (no code execution or confirmed data exposure), and depends entirely on social delivery of the malicious file plus the user's decision to play it.

All signals converge on LOW real-world priority despite the medium 4.8 base score. The CVSS 4.0 vector is local and interaction-dependent (AV:L/AC:L/AT:N/PR:N/UI:P) with the only impact being availability (VA:L) - a crash - and no confidentiality or integrity impact (VC:N/VI:N), so this is a denial-of-service of a client-side media player, not a code-execution or data-exposure flaw. EPSS is 0.13% (3rd percentile), indicating very low predicted exploitation, and there is NO CISA KEV listing, so there is no evidence of active exploitation. The vuln.today decision label is 'this_month', the second-lowest urgency tier - not 'act_now' or 'emergency'. Note a tag/impact tension: the input tags include 'Information Disclosure', but the description and the CVSS vector (VC:N) describe a crash from an out-of-bounds READ with no attacker-observable data exposure, so treat this as a DoS, not confirmed information disclosure. The only amplifying factor is PR:N (no authentication to craft a file), but that is offset by the local vector and mandatory user interaction (the victim must choose to play the malicious file).

An attacker crafts a malicious VGM file containing wait opcodes and omitting the 0x66 end-of-data terminator, then distributes it (e.g., bundled with chiptune/ROM archives) to a user of gbsplay 0.0.103 or earlier. When the victim plays the file, vgm_open() in gbs.c walks the command stream without bounds checks, reads past the end of the heap buffer, and crashes the player. A public PoC reference exists (hackmd write-up and GitHub issue #201); it is not verified as working exploit code, and the local vector plus required user interaction keep impact limited to a crash.