CVEvulnerability
CVE-2026-116725
6.8 MEDIUM
Official page ↗
- Status
- Deferred
- Published
- 2026-10-26
- Last modified
- 2026-10-27
- Assigner
- [email protected]
- CVSS 4.0 ([email protected])
- 6.8 MEDIUM — CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- CVSS 3.1 ([email protected])
- 5.5 MEDIUM — CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
- Weaknesses
- CWE-125
Description
gbsplay through 0.0.103 contains an out-of-bounds read vulnerability in mapper_map() in mapper.c that fails to reject ROM bank indexes beyond the ROM size, causing an underflowed bank length. Attackers can supply crafted .gbr, .gbs or .gb files with malicious bank indexes to make bank_get() read far past the heap ROM buffer and crash the player.
Related
Weakness · CWE (1)
- CWE-125 Out-of-bounds Read weakness
References
- https://github.com/mmitch/gbsplay github.com
- https://github.com/mmitch/gbsplay/blob/0.0.103/mapper.c#L71-L103 github.com
- https://github.com/mmitch/gbsplay/commit/a281d80bc56ed63347daf740a2f7aa4f8516165a github.com
- https://github.com/mmitch/gbsplay/issues/201 github.com
- https://hackmd.io/@haindpwn/gbsplay-rom-bank-index-oob-read hackmd.io
- https://www.vulncheck.com/advisories/gbsplay-through-0.0.103-out-of-bounds-read-via-mapper-map-rom-bank-index www.vulncheck.com