[NotCVE-2026-0016] game-music-emu VGM Command Interpreter Unvalidated 0xE0 PCM Seek Offset Allows Out-of-Bounds Read and Denial of Service
An unvalidated VGM PCM seek offset in libgme can crash the host or read out of bounds.
NotCVE-2026-0016 describes an out-of-bounds read in the VGM command interpreter of game-music-emu (libgme). An unvalidated 0xE0 PCM seek offset in a crafted .vgm or .vgz file can crash the hosting process or expose adjacent memory. The advisory does not report that the flaw is being exploited.
- VGM interpreter does not validate the 0xE0 PCM seek offset.
- A crafted .vgm or .vgz file triggers an out-of-bounds read.
- Impact includes crashing the hosting process.
- Tracked as NotCVE-2026-0016; no active exploitation is stated.
Posted by advisories on Sep 29 ---------------------------------------------------------------------------- NotCVE Advisory — NotCVE-2026-0016 ---------------------------------------------------------------------------- [-] Summary: An out-of-bounds read in the VGM command interpreter of game-music-emu (libgme), the open-source video game music emulation library, allows an attacker who supplies a crafted .vgm or .vgz file to crash the hosting process or to have adjacent...
This source does not provide full text. Read it at seclists.org.