CVE-2026-111148
libsidplayfp through 3.1.1 Heap Out-of-Bounds Read via SidTuneBase::acceptSidTune
CVSS Score
5.5
EPSS Score
0.0%
EPSS Percentile
0th
libsidplayfp through 3.1.1 contains a heap out-of-bounds read vulnerability that allows attackers to crash applications by supplying a PSID/RSID file with an unchecked data offset. Attackers can set the header data offset beyond the file size, wrapping the length calculation so resolveAddrs() reads up to 64 KiB past the heap buffer.
| CWE | CWE-125 |
| Vendor | libsidplayfp |
| Product | libsidplayfp |
| Published | Oct 15, 2026 |
Stay Ahead of the Next One
Get instant alerts for libsidplayfp libsidplayfp
Be the first to know when new medium vulnerabilities affecting libsidplayfp libsidplayfp are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
Affected Versions
libsidplayfp / libsidplayfp
0 ≤ 3.1.1
References
hackmd.io: https://hackmd.io/@haind-pwn/libsidplayfp-psid-dataoffset-underflow-oob-read github.com: https://github.com/libsidplayfp/libsidplayfp/blob/732fa8ec8131fc75aafc2eaea583ddcdeea2a3cc/src/sidtune/SidTuneBase.cpp#L295-L300 github.com: https://github.com/libsidplayfp/libsidplayfp/blob/732fa8ec8131fc75aafc2eaea583ddcdeea2a3cc/src/sidtune/SidTuneBase.cpp#L488-L500 github.com: https://github.com/libsidplayfp/libsidplayfp vulncheck.com: https://www.vulncheck.com/advisories/libsidplayfp-through-3.1.1-heap-out-of-bounds-read-via-sidtunebase-acceptsidtune
Credits
HaiND from the Post and Telecommunication Institute of Technology