[NotCVE-2026-0019] game-music-emu through 0.6.5 VGM Command Interpreter Missing Operand Length Check Allows Heap Out-of-Bounds Read
game-music-emu through 0.6.5 can leak heap memory when parsing a crafted VGM or VGZ file.
NotCVE-2026-0019 describes a heap out-of-bounds read in the VGM command interpreter of game-music-emu (libgme) through version 0.6.5. The interpreter does not check operand length, so a crafted .vgm or .vgz file can read heap memory past the end of the buffer. The advisory does not report in-the-wild exploitation.
- Affects game-music-emu (libgme) through version 0.6.5.
- VGM command interpreter skips an operand length check.
- A crafted .vgm or .vgz file can read past a heap buffer.
- Tracked as NotCVE-2026-0019; no exploitation is reported.
Posted by advisories on Sep 29 ---------------------------------------------------------------------------- NotCVE Advisory — NotCVE-2026-0019 ---------------------------------------------------------------------------- [-] Summary: An out-of-bounds read in the VGM command interpreter of game-music-emu (libgme), the open-source video game music emulation library, allows an attacker who supplies a crafted .vgm or .vgz file to read heap memory past the end of the buffer...
This source does not provide full text. Read it at seclists.org.