CVE-2026-116725

gbsplay through 0.0.103 contains an out-of-bounds read vulnerability in mapper_map() in mapper.c that fails to reject ROM bank indexes beyond the ROM size, causing an underflowed bank length. Attackers can supply crafted .gbr, .gbs or .gb files with malicious bank indexes to make bank_get() read far past the heap ROM buffer and crash the player.

CVSS v3 5.5 MEDIUM

5.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/mmitch/gbsplay
https://github.com/mmitch/gbsplay/blob/0.0.103/mapper.c#L71-L103
https://github.com/mmitch/gbsplay/commit/a281d80bc56ed63347daf740a2f7aa4f8516165a
https://github.com/mmitch/gbsplay/issues/201
https://hackmd.io/@haindpwn/gbsplay-rom-bank-index-oob-read
https://www.vulncheck.com/advisories/gbsplay-through-0.0.103-out-of-bounds-read-via-mapper-map-rom-bank-index

Configurations

No configuration.

History

26 Oct 2026, 22:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-10-26 22:16

Updated : 2026-10-27 15:55

NVD link : CVE-2026-116725

Mitre link : CVE-2026-116725

CVE.ORG link : CVE-2026-116725

JSON object : View

Products Affected

No product.

CWE

CWE-125

Out-of-bounds Read

{"id": "CVE-2026-116725", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.8}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.8, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"repo": "https://github.com/mmitch/gbsplay", "vendor": "mmitch", "product": "gbsplay", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "0.0.103"}], "packageURL": "pkg:github/mmitch/gbsplay", "defaultStatus": "unaffected"}]}], "published": "2026-10-26T22:16:56.210", "references": [{"url": "https://github.com/mmitch/gbsplay", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/mmitch/gbsplay/blob/0.0.103/mapper.c#L71-L103", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/mmitch/gbsplay/commit/a281d80bc56ed63347daf740a2f7aa4f8516165a", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/mmitch/gbsplay/issues/201", "source": "disclosure@vulncheck.com"}, {"url": "https://hackmd.io/@haindpwn/gbsplay-rom-bank-index-oob-read", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/gbsplay-through-0.0.103-out-of-bounds-read-via-mapper-map-rom-bank-index", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Primary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-125"}]}], "descriptions": [{"lang": "en", "value": "gbsplay through 0.0.103 contains an out-of-bounds read vulnerability in mapper_map() in mapper.c that fails to reject ROM bank indexes beyond the ROM size, causing an underflowed bank length. Attackers can supply crafted .gbr, .gbs or .gb files with malicious bank indexes to make bank_get() read far past the heap ROM buffer and crash the player."}], "lastModified": "2026-10-27T15:55:51.450", "sourceIdentifier": "disclosure@vulncheck.com"}