Game Music Emu
Monthly
Opening a malicious NSF file through libgme's gme_open_data or gme_open_file entry points can crash the host application via a global out-of-bounds read in Classic_Emu::mute_voices_, as a chip_flags value such as 0x3F implies a voice count exceeding the fixed 16-entry voice-type table. This affects Game Music Emu (libgme) through version 0.6.5; the vulnerability is local (AV:L) and requires user interaction (UI:P) to load the crafted file, but requires no privileges (PR:N). Publicly available exploit code exists, and the CVSS 4.0 base score is 6.8, though no confirmed active exploitation (CISA KEV) has been observed. No vendor-released patch has been identified at time of analysis.
Heap out-of-bounds read in libgme (Game Music Emu) through 0.6.5 allows local attackers to crash applications that parse a crafted ZXAYEMUL (AY-format) file through gme_track_info or gme_start_track. The root cause is an integer underflow in the AY loader's track-table bounds check in gme/Ay_Emu.cpp; the assessed impact is denial of service (process crash) with no confirmed code execution or data disclosure, and exploitation requires that the victim opens or otherwise processes a malicious file. Publicly available exploit code exists, but there is no CISA KEV confirmation of active exploitation, and the assessed CVSS:3.1 vector is AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H.
The Mem_File_Reader::read_avail function in Data_Reader.cpp in the Game_Music_Emu library (aka game-music-emu) 0.6.1 does not ensure a non-negative size, which allows remote attackers to cause a. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
game-music-emu before 0.6.1 mishandles unspecified integer values. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
game-music-emu before 0.6.1 allows local users to cause a denial of service (divide by zero and process crash). Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
game-music-emu before 0.6.1 allows remote attackers to generate out of bounds 8-bit values. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available.
game-music-emu before 0.6.1 allows remote attackers to write to arbitrary memory locations. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available.
Stack-based buffer overflow in game-music-emu before 0.6.1. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available.
Opening a malicious NSF file through libgme's gme_open_data or gme_open_file entry points can crash the host application via a global out-of-bounds read in Classic_Emu::mute_voices_, as a chip_flags value such as 0x3F implies a voice count exceeding the fixed 16-entry voice-type table. This affects Game Music Emu (libgme) through version 0.6.5; the vulnerability is local (AV:L) and requires user interaction (UI:P) to load the crafted file, but requires no privileges (PR:N). Publicly available exploit code exists, and the CVSS 4.0 base score is 6.8, though no confirmed active exploitation (CISA KEV) has been observed. No vendor-released patch has been identified at time of analysis.
Heap out-of-bounds read in libgme (Game Music Emu) through 0.6.5 allows local attackers to crash applications that parse a crafted ZXAYEMUL (AY-format) file through gme_track_info or gme_start_track. The root cause is an integer underflow in the AY loader's track-table bounds check in gme/Ay_Emu.cpp; the assessed impact is denial of service (process crash) with no confirmed code execution or data disclosure, and exploitation requires that the victim opens or otherwise processes a malicious file. Publicly available exploit code exists, but there is no CISA KEV confirmation of active exploitation, and the assessed CVSS:3.1 vector is AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H.
The Mem_File_Reader::read_avail function in Data_Reader.cpp in the Game_Music_Emu library (aka game-music-emu) 0.6.1 does not ensure a non-negative size, which allows remote attackers to cause a. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
game-music-emu before 0.6.1 mishandles unspecified integer values. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
game-music-emu before 0.6.1 allows local users to cause a denial of service (divide by zero and process crash). Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
game-music-emu before 0.6.1 allows remote attackers to generate out of bounds 8-bit values. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available.
game-music-emu before 0.6.1 allows remote attackers to write to arbitrary memory locations. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available.
Stack-based buffer overflow in game-music-emu before 0.6.1. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available.