CVE-2026-61542 Details
Description
Gearboy is a Game Boy, Game Boy Color, and Super Game Boy emulator and debugger with an embedded MCP server. Gearsystem, the affected component, has an optional `--mcp-http` mode that accepts unauthenticated MCP requests from any reachable network peer despite localhost-only documentation and logging. In the described `platforms/shared/desktop/mcp/mcp_transport.h` transport, the socket binds `INADDR_ANY`, normally on port 7777, and POST requests to `/mcp` reach dispatch without `Authorization`, `Host`, or `Origin` checks. Responses and OPTIONS advertise `Access-Control-Allow-Origin: *`. A peer can initialize an MCP session and invoke exposed emulator/debugging operations; even a garbage bearer token does not block dispatch, while a loopback-bind negative control prevents network access. The reported impact is bounded to the emulator process, debugging state, and local files accepted as media, rather than demonstrated host code execution. Gearboy 3.8.7 contains a patch.
A vulnerability in Gearboy's embedded MCP HTTP transport component, Gearsystem, allows unauthenticated access to debugging tools from any reachable network peer. This issue arises because the HTTP transport binds to all IPv4 interfaces, contrary to the documented localhost-only restriction, and accepts MCP requests without authentication. As a result, a remote peer can initiate an MCP session and invoke various emulator operations, including memory writing, through the exposed tools. The vulnerability affects Gearboy versions through 3.8.6, with the 3.8.7 release containing a patch.
Users can update to Gearboy version 3.8.7, which binds the HTTP transport to localhost by default and requires authentication for MCP requests.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 28, 2026CISA-ADP
Assessed Nov 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/drhelius/Gearboy/security/advisories/GHSA-fmvx-487g-mrww | CISA-ADP | AdvisoryRemedyVendor |
| https://github.com/drhelius/Gearboy/commit/e2ead98e2fac41e9df5a499e9e421c6a0e73f1bc | [email protected] | Source CodeVendor |
| https://github.com/drhelius/Gearboy/releases/tag/3.8.7 | [email protected] | Release NotesVendor |
| https://github.com/drhelius/Gearboy/security/advisories/GHSA-fmvx-487g-mrww | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-306 | Missing Authentication for Critical Function | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Gearboy | <= 3.8.6 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 3, 2026 | CVE Modified | CISA-ADP |
| Oct 28, 2026 | New CVE Received | [email protected] |