[NotCVE-2026-0019] game-music-emu through 0.6.5 VGM Command Interpreter Missing Operand Length Check Allows Heap Out-of-Bounds Read
game-music-emu through 0.6.5 has a heap out-of-bounds read via crafted VGM files.
A NotCVE advisory describes a heap out-of-bounds read in the VGM command interpreter of game-music-emu (libgme) through version 0.6.5. A missing operand-length check lets an attacker who supplies a crafted .vgm or .vgz file read heap memory past the end of the buffer. The issue is tracked as NotCVE-2026-0019 rather than a CVE. No in-the-wild exploitation is reported.
- Heap out-of-bounds read in the VGM command interpreter.
- A crafted .vgm or .vgz file can read past the buffer.
- Affects game-music-emu (libgme) through version 0.6.5.
- Published as NotCVE-2026-0019, not a standard CVE.
Posted by advisories on Sep 30 ---------------------------------------------------------------------------- NotCVE Advisory — NotCVE-2026-0019 ---------------------------------------------------------------------------- [-] Summary: An out-of-bounds read in the VGM command interpreter of game-music-emu (libgme), the open-source video game music emulation library, allows an attacker who supplies a crafted .vgm or .vgz file to read heap memory past the end of the buffer...
This source does not provide full text. Read it at seclists.org.