[NotCVE-2026-0019] game-music-emu through 0.6.5 VGM Command Interpreter Missing Operand Length Check Allows Heap Out-of-Bounds Read
game-music-emu through 0.6.5 has a heap out-of-bounds read via crafted VGM files.
A NotCVE advisory describes a heap out-of-bounds read in the VGM command interpreter of game-music-emu (libgme) through version 0.6.5. A missing operand-length check lets an attacker who supplies a crafted .vgm or .vgz file read heap memory past the end of the buffer. The issue is tracked as NotCVE-2026-0019 rather than a CVE. No in-the-wild exploitation is reported.
24