EUVD-2026-110506
GHSA-vhg9-cjjj-f7v6
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessVictim opens crafted .gbs/.gbr/.gb file
-
Exploitmapper_map() accepts out-of-range ROM bank index
-
ExecutionUnderflowed bank length yields oversized read in bank_get()
-
ImpactOut-of-bounds heap read crashes player (denial of service)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a victim to open an attacker-supplied crafted .gbr, .gbs or .gb file containing a ROM bank index beyond the actual ROM size, in gbsplay version 0.0.103 or earlier. Limiting factors: the attack vector is local and demands user interaction (the user must load the malicious file) - there is no remote or unauthenticated network trigger - and per the source evidence the impact is confined to crashing the player process (availability), with no code execution and no data read back to the attacker. No special product configuration or non-default mode is needed; any affected version parsing the file is susceptible. |
| Impact | This is a low-to-moderate real-world priority despite the 6.8 CVSS 4.0 score. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H) describes a local, low-complexity flaw with no privileges but passive user interaction, and the impact is confined to availability (VA:H) with no confidentiality or integrity effect - consistent with the description's 'crash the player' outcome and the CWE-125 out-of-bounds read. The multi-source signals align toward low urgency: EPSS is 0.14% (3rd percentile), there is no CISA KEV listing, and the vuln.today decision label is 'this_month' rather than act_now or emergency. The signals are internally consistent - a DoS-only bug in a local media/file parser, triggered only when a user opens a malicious file, is exactly the kind of issue EPSS rates low. The main caveat is that CVSS rates availability impact HIGH, which overstates business risk here because the affected product is a niche Game Boy sound player and the worst case is a crash of that single player process, not a service or system outage. A patch is available from the vendor, so remediation is straightforward. |
| Exploit ScenarioDerived | An attacker distributes a malicious .gbs, .gbr or .gb file (e.g. via a chiptune archive or download) whose ROM bank index points beyond the actual ROM size. When a victim opens the file in gbsplay 0.0.103 or earlier, mapper_map() computes an underflowed bank length and bank_get() reads far past the heap ROM buffer, crashing the player. A public analysis writeup exists but is not verified as working exploit code; exploitation requires the victim to actively open the crafted file. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 28, 2026
An out-of-bounds read in gbsplay 0.0.103 and earlier lets a crafted Game Boy sound file crash the player: mapper_map() in mapper.c accepts a ROM bank index larger than the actual ROM, computing an underflowed bank length that bank_get() then reads past the end of the heap-allocated ROM buffer. The attack is local and requires the victim to open a malicious .gbr, .gbs or .gb file (CVSS 4.0 6.8; PR:N but UI:P), and the confirmed impact is a denial of service against the player process rather than code execution or disclosure of data back to the attacker. No public exploit code was identified at time of analysis, and EPSS is low at 0.14% (3rd percentile); an upstream fix commit exists, but a tagged release containing it is not independently confirmed. This is a low-to-moderate real-world priority despite the 6.8 CVSS 4.0 score.
RemediationAI
Apply the upstream fix commit a281d80bc56ed63347daf740a2f7aa4f8516165a (https://github.com/mmitch/gbsplay/commit/a281d80bc56ed63347daf740a2f7aa4f8516165a), which adds an explicit max_banks bound check in mapper_map(), corrects the off-by-one boundaries in bank_get()/bank_put() and only maps bank 1 when the ROM exceeds MAPPER_ROMBANK_SIZE; because the input identifies this as a commit rather than a tagged release, verify whether your distribution's gbsplay package has backported it before relying on a version number alone. Distributions and downstream packagers should carry that commit as a patch against 0.0.103 until a tagged release is available. Where the player cannot be rebuilt immediately, the practical compensating control is to avoid opening untrusted or unknown-origin .gb/.gbs/.gbr files - and to avoid automating gbsplay over downloaded file collections - accepting that this removes the tool's primary use case for untrusted content; running playback in a sandboxed or resource-limited process contains the consequence of the out-of-bounds read, which per the assessment is a crash of the player only. No vendor workaround beyond the code fix is documented in the available references.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
gbsplay emulates the Game Boy sound hardware and loads ROM images (.gb, .gbs, .gbr) into a heap buffer, with mapper.c providing the bank-switching abstraction that memory-mapped reads and writes go through. The flaw is CWE-125 (out-of-bounds read) rooted in missing validation of the bank index: mapper_map() computed the bank offset with size_t arithmetic and used a 'len <= 0' guard that can never be true for an unsigned type, so a bank index beyond the ROM's bank count produced a wrapped/underflowed length instead of a rejection, and bank_get() subsequently read far past the allocated ROM buffer. Per the source evidence, the upstream commit a281d80bc56ed63347daf740a2f7aa4f8516165a restructures the check to compute max_banks = size / b->banksize and reject bank < 0 or bank >= max_banks before computing the offset, tightens the bounds tests in bank_get() and bank_put() from '>' to '>=' against b->size, and changes the upper ROM mapping in mapper_gbs() and mapper_gb() to map bank 1 only when size > MAPPER_ROMBANK_SIZE (falling back to bank 0 for single-bank ROMs). Only the 0.0.103 line of mapper.c (lines 71-103 in the referenced file) is confirmed affected in the available sources; the exact mechanism by which a malformed bank index reaches mapper_map() for each container format is not described in the supplied data beyond the fact that crafted .gbr/.gbs/.gb files can carry it.
Know when Gbsplay gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
File must be opened locally by the user, so AV:L and UI:R; no privileges needed (PR:N); impact is a crash only, so C:N/I:N and A:H.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
gbsplay through 0.0.103 contains an out-of-bounds read vulnerability in mapper_map() in mapper.c that fails to reject ROM bank indexes beyond the ROM size, causing an underflowed bank length. Attackers can supply crafted .gbr, .gbs or .gb files with malicious bank indexes to make bank_get() read far past the heap ROM buffer and crash the player.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Heap out-of-bounds read in gbsplay's VGM loader (vgm_open() in gbs.c) allows a crafted .vgm file to walk the command-str
Heap out-of-bounds read in gbsplay 0.0.103 and earlier lets anyone who opens a crafted GBR file sized between 0x21 and 0
Exploit-DB