Four game-music-emu flaws allow crashes and memory reads

Four Full Disclosure advisories describe NotCVE flaws in game-music-emu that can crash apps or read memory from crafted music files.

On 1 October 2026, Full Disclosure published four separate advisories for game-music-emu (libgme), tracked as NotCVE-2026-0016 through NotCVE-2026-0019 rather than official CVEs. NotCVE-2026-0016 is an unvalidated 0xE0 PCM seek offset in the VGM command interpreter; a crafted .vgm or .vgz file can trigger an out-of-bounds read that crashes the host process or accesses adjacent memory, and that report states no version range. NotCVE-2026-0017 is a NULL pointer dereference in the AY loader of libgme 0.6.5 and earlier that ends any application which begins playback of a crafted .ay file. NotCVE-2026-0018 and NotCVE-2026-0019 both affect libgme through 0.6.5: an unbounded GYM command loop and a missing VGM operand-length check, respectively, so a crafted .gym or .vgm/.vgz file can read heap memory past the allocation. None of the reports mention in-the-wild exploitation, and they do not conflict on impact; only the version bound is absent from the first advisory.

• On 2026-10-01 Full Disclosure published four advisories: NotCVE-2026-0016, NotCVE-2026-0017, NotCVE-2026-0018, and NotCVE-2026-0019.
• All concern game-music-emu (libgme); the reports present them as NotCVEs rather than official CVEs and do not report in-the-wild exploitation.
• NotCVE-2026-0016: an unvalidated 0xE0 PCM seek offset in the VGM interpreter lets a crafted .vgm or .vgz file cause an out-of-bounds read, a host-process crash, or adjacent memory access; no version range is stated.
• NotCVE-2026-0017: a NULL pointer dereference in the AY loader of libgme 0.6.5 and earlier terminates apps that start playback of a crafted .ay file (denial of service).
• NotCVE-2026-0018: an unbounded GYM command loop in libgme through 0.6.5 lets a crafted .gym file read heap memory past its allocation.
• NotCVE-2026-0019: a missing operand-length check in the VGM interpreter of libgme through 0.6.5 lets a crafted .vgm or .vgz file read heap memory past the buffer.