[NotCVE-2026-0016] game-music-emu VGM Command Interpreter Unvalidated 0xE0 PCM Seek Offset Allows Out-of-Bounds Read and Denial of Service
A crafted VGM file can crash libgme or read memory via an unchecked PCM seek.
NotCVE-2026-0016 describes an out-of-bounds read in the VGM command interpreter of game-music-emu (libgme). An unvalidated 0xE0 PCM seek offset in a crafted .vgm or .vgz file can crash the hosting process or access adjacent memory. No in-the-wild exploitation is mentioned.
- Unvalidated 0xE0 PCM seek offset in the VGM interpreter.
- Crafted .vgm or .vgz files trigger an out-of-bounds read.
- Impact is a host-process crash or adjacent memory access.
- Tracked as NotCVE-2026-0016; exploitation is not reported.
Posted by advisories on Sep 30 ---------------------------------------------------------------------------- NotCVE Advisory — NotCVE-2026-0016 ---------------------------------------------------------------------------- [-] Summary: An out-of-bounds read in the VGM command interpreter of game-music-emu (libgme), the open-source video game music emulation library, allows an attacker who supplies a crafted .vgm or .vgz file to crash the hosting process or to have adjacent...
This source does not provide full text. Read it at seclists.org.