Gbsplay
Monthly
Heap out-of-bounds read in gbsplay's VGM loader (vgm_open() in gbs.c) allows a crafted .vgm file to walk the command-stream parser past the end of its heap buffer and crash the player. All builds through 0.0.103 are affected; the trigger is a VGM stream containing wait opcodes without the 0x66 end-of-data terminator, which leaves the parse loop running to and beyond the buffer boundary. The vector is local and requires the victim to open or play the malicious file (CVSS:3.1/AV:L/AC:L/PR:N/UI:R), and impact is confined to availability - no code execution or confirmed disclosure. EPSS is 0.13% (3rd percentile), there is no KEV entry or confirmed active exploitation, no verified working exploit code is publicly available (a public technical write-up exists but is not verified as working exploit code), and a bounds-checking upstream fix commit is referenced.
Heap out-of-bounds read in gbsplay 0.0.103 and earlier lets anyone who opens a crafted GBR file sized between 0x21 and 0x162 bytes read past the end of a heap buffer while gbr_open() in gbs.c scans the ROM title field, crashing the player or leaking a small amount of adjacent heap memory. The flaw is reachable in the default configuration with no special option enabled, but it requires the victim to load the attacker-supplied file locally, so it is a low-priority local issue with no code execution or integrity impact (CVSS 4.0 base 4.8; independent assessment CVSS 3.1 AV:L/AC:L/PR:N/UI:R, C:L/A:L; EPSS 0.13%, 2nd percentile). Vulnerability is not in CISA KEV and SSVC records exploitation as none; a public technical writeup describing the flaw exists, and an upstream fix commit is available.
An out-of-bounds read in gbsplay 0.0.103 and earlier lets a crafted Game Boy sound file crash the player: mapper_map() in mapper.c accepts a ROM bank index larger than the actual ROM, computing an underflowed bank length that bank_get() then reads past the end of the heap-allocated ROM buffer. The attack is local and requires the victim to open a malicious .gbr, .gbs or .gb file (CVSS 4.0 6.8; PR:N but UI:P), and the confirmed impact is a denial of service against the player process rather than code execution or disclosure of data back to the attacker. No public exploit code was identified at time of analysis, and EPSS is low at 0.14% (3rd percentile); an upstream fix commit exists, but a tagged release containing it is not independently confirmed. This is a low-to-moderate real-world priority despite the 6.8 CVSS 4.0 score.
Heap out-of-bounds read in gbsplay's VGM loader (vgm_open() in gbs.c) allows a crafted .vgm file to walk the command-stream parser past the end of its heap buffer and crash the player. All builds through 0.0.103 are affected; the trigger is a VGM stream containing wait opcodes without the 0x66 end-of-data terminator, which leaves the parse loop running to and beyond the buffer boundary. The vector is local and requires the victim to open or play the malicious file (CVSS:3.1/AV:L/AC:L/PR:N/UI:R), and impact is confined to availability - no code execution or confirmed disclosure. EPSS is 0.13% (3rd percentile), there is no KEV entry or confirmed active exploitation, no verified working exploit code is publicly available (a public technical write-up exists but is not verified as working exploit code), and a bounds-checking upstream fix commit is referenced.
Heap out-of-bounds read in gbsplay 0.0.103 and earlier lets anyone who opens a crafted GBR file sized between 0x21 and 0x162 bytes read past the end of a heap buffer while gbr_open() in gbs.c scans the ROM title field, crashing the player or leaking a small amount of adjacent heap memory. The flaw is reachable in the default configuration with no special option enabled, but it requires the victim to load the attacker-supplied file locally, so it is a low-priority local issue with no code execution or integrity impact (CVSS 4.0 base 4.8; independent assessment CVSS 3.1 AV:L/AC:L/PR:N/UI:R, C:L/A:L; EPSS 0.13%, 2nd percentile). Vulnerability is not in CISA KEV and SSVC records exploitation as none; a public technical writeup describing the flaw exists, and an upstream fix commit is available.
An out-of-bounds read in gbsplay 0.0.103 and earlier lets a crafted Game Boy sound file crash the player: mapper_map() in mapper.c accepts a ROM bank index larger than the actual ROM, computing an underflowed bank length that bank_get() then reads past the end of the heap-allocated ROM buffer. The attack is local and requires the victim to open a malicious .gbr, .gbs or .gb file (CVSS 4.0 6.8; PR:N but UI:P), and the confirmed impact is a denial of service against the player process rather than code execution or disclosure of data back to the attacker. No public exploit code was identified at time of analysis, and EPSS is low at 0.14% (3rd percentile); an upstream fix commit exists, but a tagged release containing it is not independently confirmed. This is a low-to-moderate real-world priority despite the 6.8 CVSS 4.0 score.