[NotCVE-2026-0017] game-music-emu (libgme) 0.6.5 and Earlier AY Loader NULL Pointer Dereference Allows Denial of Service
libgme 0.6.5 and earlier crashes applications that play a crafted AY file.
NotCVE-2026-0017 covers a NULL pointer dereference in the AY file loader of game-music-emu (libgme) 0.6.5 and earlier. Supplying a crafted .ay file can terminate any application that begins playback of it. The impact is denial of service, and no in-the-wild exploitation is reported.
- NULL pointer dereference in the AY file loader.
- A crafted .ay file crashes apps that start playback.
- Affects game-music-emu (libgme) 0.6.5 and earlier.
- Tracked as NotCVE-2026-0017; impact is denial of service.
Posted by advisories on Sep 30 ---------------------------------------------------------------------------- NotCVE Advisory — NotCVE-2026-0017 ---------------------------------------------------------------------------- [-] Summary: A NULL pointer dereference in the AY file loader of game-music-emu (libgme), the open-source video game music emulation library, allows an attacker who supplies a crafted .ay file to terminate any application that begins playback of it. CVSS:3.1...
This source does not provide full text. Read it at seclists.org.