CVE-2026-111152: game-music-emu 0 through 0.6.5

Affected technology

game-music-emu · 0 through 0.6.5
libgme

Description’s affected range: through 0.6.5

Component: Not specified by the source
Function: caused

Attack conditions (Vendor/CNA, CVSS 4.0): Local · No privileges required · Passive user interaction

What an attacker can do

Attackers can supply a crafted ZXAYEMUL file with an oversized track table to read past the file buffer via gme_track_info or gme_start_track, crashing libgme consumers. Vendor/CNA’s CVSS 4.0 assessment (base score 6.8/10) rates confidentiality and integrity impact as none; availability impact as high.