What is the CVSS score of CVE-2026-39199?

CVE-2026-39199 has a CVSS 3.1 base score of 2.9 (Low). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L. EPSS exploitation probability: 0.1%.

snes9x CVE-2026-39199

LOW

Out-of-bounds Write (CWE-787)

2026-06-17 mitre

Buffer Overflow Denial Of Service Memory Corruption Snes9X

2.9

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

2.9 LOW

AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

vuln.today AI

3.6 LOW

UI:R added because user must actively apply the crafted .ups file; I:L added since CWE-787 out-of-bounds write implies at least minor memory integrity impact beyond pure DoS.

3.1 AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L

4.0 AV:L/AC:H/AT:N/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Local

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Lifecycle Timeline

Source Code Evidence Fetched

Jun 17, 2026 - 18:01 vuln.today

Analysis Generated

Jun 17, 2026 - 18:01 vuln.today

DescriptionCVE.org

snes9x 1.63 allows an out-of-bounds write and denial of service via a crafted .ups file.

AnalysisAI

Out-of-bounds write in snes9x 1.63's UPS patch file parser allows a crafted .ups ROM patch file to trigger memory corruption and a denial-of-service crash. The flaw resides in the ReadUPSPatch loop in memmap.cpp, where the loop iterator relative was not bounded against CMemory::MAX_ROM_SIZE, permitting writes past the end of the allocated ROM buffer. Impact is limited to availability (crash) per the CVSS vector, though the underlying CWE-787 out-of-bounds write class carries broader memory-safety implications. No public exploit identified at time of analysis, and CVSS rates this Low (2.9) due to local attack vector and high complexity.

Technical ContextAI

snes9x is an open-source Super Nintendo Entertainment System emulator maintained by the snes9x team (CPE: cpe:2.3:a:snes9x_team:snes9x). The UPS patch format is used to apply binary patches to ROM files. The vulnerable code in memmap.cpp iterates over a UPS patch stream with the condition while(addr < size - 12), advancing a relative offset without checking it against CMemory::MAX_ROM_SIZE. CWE-787 (Out-of-Bounds Write) is the root cause: the missing bounds check on relative allows the write cursor to exceed the ROM buffer boundary. The fix, visible in commit 96b366100172723f6314c40e237b370f4f7b59f4, adds && relative < CMemory::MAX_ROM_SIZE as a second loop guard. This is a classic unbounded loop write pattern where one dimension of the input (file size) is checked but a derived internal offset is not independently validated.

RemediationAI

An upstream fix is available via commit 96b366100172723f6314c40e237b370f4f7b59f4 on the snes9x GitHub repository (https://github.com/snes9xgit/snes9x/commit/96b366100172723f6314c40e237b370f4f7b59f4); however, a formally released patched version is not independently confirmed from the available data - users should check https://github.com/snes9xgit/snes9x/releases for a tagged release incorporating this commit. As a compensating control, users should avoid applying UPS patch files obtained from untrusted or unverified sources, which eliminates the attack surface without requiring an update. Distribution package maintainers (Debian, Arch, Homebrew, etc.) should cherry-pick the fix commit into their packaged versions. There are no configuration settings within snes9x to disable UPS patch support, so source-level patching or abstaining from untrusted .ups files are the only mitigations available.