Answer in brief
CVE-2026-111153 records a Medium severity (CVSS 6.8) vulnerability in Game Music Emu (libgme) through 0.6.5 Out-of-Bounds Read via Classic_Emu::mute_voices_. The current sources do not mark it as known exploited. The current feed maps libgme/game-music-emu (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 6.8. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps libgme/game-music-emu (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| libgme/game-music-emugeneric | >=0 <=0.6.5 | Not reported |
Published upstream
Oct 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Oct 15, 2026
Game Music Emu (libgme) through 0.6.5 contains a global out-of-bounds read vulnerability in Classic_Emu::mute_voices_ that allows attackers to crash applications by supplying NSF files whose voice count exceeds the 16-entry voice-type table. Attackers can craft an NSF header with chip_flags 0x3F, opened through gme_open_data or gme_open_file, to read past the static array during loading and cause denial of service.
Quoted source text, attributed separately from HOL analysis.