CVE-2026-116725

Description

gbsplay through 0.0.103 contains an out-of-bounds read vulnerability in mapper_map() in mapper.c that fails to reject ROM bank indexes beyond the ROM size, causing an underflowed bank length. Attackers can supply crafted .gbr, .gbs or .gb files with malicious bank indexes to make bank_get() read far past the heap ROM buffer and crash the player.

References

https://www.vulncheck.com/advisories/gbsplay-through-0.0.103-out-of-bounds-read-via-mapper-map-rom-bank-index

https://hackmd.io/@haindpwn/gbsplay-rom-bank-index-oob-read

https://github.com/mmitch/gbsplay/issues/201

https://github.com/mmitch/gbsplay/commit/a281d80bc56ed63347daf740a2f7aa4f8516165a

https://github.com/mmitch/gbsplay/blob/0.0.103/mapper.c#L71-L103

https://github.com/mmitch/gbsplay

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-110506

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3

CVSS v4

EPSS