[NotCVE-2026-0018] game-music-emu (libgme) through 0.6.5 Unbounded GYM Command Loop Allows Heap Out-of-Bounds Read
libgme through 0.6.5 heap-reads past a buffer when playing a crafted GYM file.
NotCVE-2026-0018 reports a heap out-of-bounds read in the GYM playback path of game-music-emu (libgme) through version 0.6.5. An unbounded GYM command loop lets a crafted .gym file read heap memory past the end of the allocation that holds the data. No observed exploitation is stated.
- Affects the GYM playback path in libgme through 0.6.5.
- An unbounded GYM command loop causes a heap out-of-bounds read.
- A crafted .gym file can read past the allocation holding file data.
- Tracked as NotCVE-2026-0018; exploitation is not reported.
Posted by advisories on Sep 29 ---------------------------------------------------------------------------- NotCVE Advisory — NotCVE-2026-0018 ---------------------------------------------------------------------------- [-] Summary: An out-of-bounds read in the GYM playback path of game-music-emu (libgme), the open-source video game music emulation library, allows an attacker who supplies a crafted .gym file to read heap memory past the end of the allocation holding the...
This source does not provide full text. Read it at seclists.org.