[NotCVE-2026-0018] game-music-emu (libgme) through 0.6.5 Unbounded GYM Command Loop Allows Heap Out-of-Bounds Read
libgme through 0.6.5 can leak heap memory when playing a crafted GYM file.
A Full Disclosure advisory assigned NotCVE-2026-0018 describes an out-of-bounds read in the GYM playback path of game-music-emu (libgme) through version 0.6.5. An unbounded GYM command loop lets a crafted .gym file read heap memory past the end of its allocation. No official CVE or in-the-wild exploitation is reported.
- Heap out-of-bounds read in the GYM playback path.
- Affects game-music-emu (libgme) through version 0.6.5.
- A crafted .gym file can read past the heap allocation.
- Tracked as NotCVE-2026-0018; no official CVE listed.
Posted by advisories on Sep 30 ---------------------------------------------------------------------------- NotCVE Advisory — NotCVE-2026-0018 ---------------------------------------------------------------------------- [-] Summary: An out-of-bounds read in the GYM playback path of game-music-emu (libgme), the open-source video game music emulation library, allows an attacker who supplies a crafted .gym file to read heap memory past the end of the allocation holding the...
This source does not provide full text. Read it at seclists.org.