CVE-2026-116725mediumCWE-125

CVE-2026-116725: medium-severity vulnerability in mmitch gbsplay

gbsplay through 0.0.103 Out-of-Bounds Read via mapper_map ROM Bank Index

Published · Updated

Follow this CVE+ Monitor gbsplay

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

33Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 6.8epss 0.1%
gbsplay through 0.0.103 contains an out-of-bounds read vulnerability in mapper_map() in mapper.c that fails to reject ROM bank indexes beyond the ROM size, causing an underflowed bank length. Attackers can supply crafted .gbr, .gbs or .gb files with malicious bank indexes to make bank_get() read far past the heap ROM buffer and crash the player.
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Affected products
mmitch · gbsplay
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — mmitch gbsplay

In the same product, most dangerous first.

CVE-2026-116727MEDIUMgbsplay through 0.0.103 Heap Out-of-Bounds Read via vgm_open in gbs.cEPSS 0.1%CVE-2026-116726MEDIUMgbsplay through 0.0.103 Heap Out-of-Bounds Read via gbr_open GBR TitleEPSS 0.1%