[NotCVE-2026-0017] game-music-emu (libgme) 0.6.5 and Earlier AY Loader NULL Pointer Dereference Allows Denial of Service
A crafted AY file can crash apps using game-music-emu 0.6.5 and earlier.
NotCVE-2026-0017 covers a NULL pointer dereference in the AY file loader of game-music-emu (libgme) 0.6.5 and earlier. Supplying a crafted .ay file can terminate any application that begins playback of that file, causing a denial of service. The post does not describe exploitation in the wild.
- NULL pointer dereference in the AY file loader.
- Affects game-music-emu 0.6.5 and earlier.
- A crafted .ay file can crash an app that starts playback.
- Tracked as NotCVE-2026-0017; impact is denial of service.
Posted by advisories on Sep 29 ---------------------------------------------------------------------------- NotCVE Advisory — NotCVE-2026-0017 ---------------------------------------------------------------------------- [-] Summary: A NULL pointer dereference in the AY file loader of game-music-emu (libgme), the open-source video game music emulation library, allows an attacker who supplies a crafted .ay file to terminate any application that begins playback of it. CVSS:3.1...
This source does not provide full text. Read it at seclists.org.