CVE-2026-116725
5.5 MEDIUMpublic exploit availablePublished 2026-10-26 · Updated 2026-10-26
AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.
NVD description
gbsplay through 0.0.103 contains an out-of-bounds read vulnerability in mapper_map() in mapper.c that fails to reject ROM bank indexes beyond the ROM size, causing an underflowed bank length. Attackers can supply crafted .gbr, .gbs or .gb files with malicious bank indexes to make bank_get() read far past the heap ROM buffer and crash the player.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weaknesses
CWE-125
Public exploit & PoC references
All references
- https://github.com/mmitch/gbsplay
- https://github.com/mmitch/gbsplay/blob/0.0.103/mapper.c#L71-L103
- https://github.com/mmitch/gbsplay/commit/a281d80bc56ed63347daf740a2f7aa4f8516165a
- https://github.com/mmitch/gbsplay/issues/201
- https://hackmd.io/@haindpwn/gbsplay-rom-bank-index-oob-read
- https://www.vulncheck.com/advisories/gbsplay-through-0.0.103-out-of-bounds-read-via-mapper-map-rom-bank-index
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- LOWCVE-2024-58392PoC
- MEDIUMCVE-2024-58397PoC
- MEDIUMCVE-2024-58399PoC
- MEDIUMCVE-2025-60494PoC
- MEDIUMCVE-2025-71438PoC
- MEDIUMCVE-2025-71439PoC
- MEDIUMCVE-2026-100126
- MEDIUMCVE-2026-100130
Related by shared AI tags and CWE weakness class. Browse the full archive.