Four libgme NotCVEs cover crashes and out-of-bounds reads

NotCVE advisories say crafted AY, GYM, and VGM files can crash libgme or read out of bounds; no exploitation is reported.

oss-security posts on 2026-09-29, mirrored on Full Disclosure on 2026-10-01, describe four game-music-emu (libgme) issues tracked as NotCVE-2026-0016 through NotCVE-2026-0019, and none report in-the-wild exploitation. NotCVE-2026-0016 is an unvalidated 0xE0 PCM seek offset in the VGM interpreter: a crafted .vgm or .vgz can cause an out-of-bounds read that crashes the host or exposes or accesses adjacent memory, and no affected version is stated. NotCVE-2026-0017 is a NULL-pointer dereference in the AY loader of 0.6.5 and earlier, where a crafted .ay file can terminate an application that starts playback. NotCVE-2026-0018, through 0.6.5, is an unbounded GYM command loop that lets a crafted .gym read heap memory past its allocation; the Full Disclosure tldr says this can leak memory and that post says no official CVE is listed, while the oss-security summary specifies a heap out-of-bounds read. NotCVE-2026-0019, also through 0.6.5, is a missing operand-length check that lets a crafted .vgm or .vgz read past a heap buffer; one tldr calls that a leak, and Full Disclosure says it is published as a NotCVE rather than a standard CVE.

• NotCVE-2026-0016: unvalidated 0xE0 PCM seek offset in the VGM interpreter; a crafted .vgm or .vgz causes an out-of-bounds read that can crash the host or expose/access adjacent memory. No version and no exploitation are stated.
• NotCVE-2026-0017: NULL-pointer dereference in the AY loader of game-music-emu (libgme) 0.6.5 and earlier; a crafted .ay file can terminate an app that starts playback (denial of service). No exploitation is stated.
• NotCVE-2026-0018: unbounded GYM command loop in libgme through 0.6.5; a crafted .gym file can read heap memory past its allocation. Full Disclosure says no official CVE is listed. No exploitation is stated.
• NotCVE-2026-0019: missing operand-length check in the VGM interpreter through 0.6.5; a crafted .vgm or .vgz can read past a heap buffer. Full Disclosure says it is a NotCVE, not a standard CVE. No exploitation is stated.
• oss-security posted the four advisories on 2026-09-29; Full Disclosure carried matching posts on 2026-10-01.
• Sources disagree on wording: some tlrs say 0018 and 0019 can "leak" heap memory, while summaries describe reads past a buffer; 0016 is "expose" adjacent memory in one report and "access" it in another.