Libsidplayfp
Monthly
Loading a crafted PSID/RSID SID tune file in applications built on libsidplayfp through 3.1.1 crashes the process through a heap out-of-bounds read. The library trusts the header's data offset without validating it against the real file size, so an attacker-supplied offset wraps the length calculation in SidTuneBase::resolveAddrs() and the code reads up to 64 KiB past the heap buffer. The confirmed impact is denial of service only - no code execution and no verified data exposure - and an attacker must get a victim to open or play the malicious tune, so this is a moderate, not high-priority, issue; publicly available exploit code exists (a HackMD write-up), but there is no confirmed active exploitation (not in CISA KEV).
Loading a crafted PSID/RSID SID tune file in applications built on libsidplayfp through 3.1.1 crashes the process through a heap out-of-bounds read. The library trusts the header's data offset without validating it against the real file size, so an attacker-supplied offset wraps the length calculation in SidTuneBase::resolveAddrs() and the code reads up to 64 KiB past the heap buffer. The confirmed impact is denial of service only - no code execution and no verified data exposure - and an attacker must get a victim to open or play the malicious tune, so this is a moderate, not high-priority, issue; publicly available exploit code exists (a HackMD write-up), but there is no confirmed active exploitation (not in CISA KEV).