CVE-2026-116726 Details
Description
Gbsplay through 0.0.103 contains a heap out-of-bounds read vulnerability in gbr_open() in gbs.c that fails to verify file length before scanning the GBR ROM title field. Attackers can supply a crafted GBR file of 0x21 to 0x162 bytes to read past the heap buffer, crashing gbsplay or leaking memory.
A heap out-of-bounds read vulnerability has been identified in Gbsplay versions through 0.0.103. The issue arises in the 'gbr_open' function within 'gbs.c', where the file length is not properly validated before reading the GBR ROM title field. This flaw allows attackers to craft GBR files ranging from 0x21 to 0x162 bytes that, when processed, can read beyond the allocated heap buffer. The exploitation of this vulnerability can lead to a crash of the Gbsplay application or cause unintended memory leakage.
Users can update to Gbsplay version 0.0.104 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 26, 2026CISA-ADP
Assessed Oct 27, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/mmitch/gbsplay | [email protected] | Vendor |
| https://github.com/mmitch/gbsplay/blob/0.0.103/gbs.c#L810-L820 | [email protected] | Source CodeVendor |
| https://github.com/mmitch/gbsplay/commit/33812ed38d84b800b5a17f639ef6625f76290785 | [email protected] | Source CodeVendor |
| https://github.com/mmitch/gbsplay/issues/201 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://hackmd.io/@haindpwn/gbsplay-rom-bank-index-oob-read | [email protected] | BundleExploitRemedyTechnical Analysis |
| https://www.vulncheck.com/advisories/gbsplay-through-0.0.103-heap-out-of-bounds-read-via-gbr-open-gbr-title | [email protected] | AdvisoryBundleRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-125 | Out-of-bounds Read | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| gbsplay | <= 0.0.103 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 27, 2026 | CVE Modified | CISA-ADP |
| Oct 26, 2026 | New CVE Received | [email protected] |