Heap out-of-bounds read in libsidplayfp lets crafted files crash apps
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Passive
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-125 and the CVSS impact.
Summary
libsidplayfp through 3.1.1 contains a heap out-of-bounds read (CWE-125) in SidTuneBase::acceptSidTune. A local attacker who supplies a PSID or RSID file with a data offset beyond the file size can make the library read up to 64 KiB past a heap buffer, crashing applications. A public exploit is linked in the references.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Description from the CNA
libsidplayfp through 3.1.1 contains a heap out-of-bounds read vulnerability that allows attackers to crash applications by supplying a PSID/RSID file with an unchecked data offset. Attackers can set the header data offset beyond the file size, wrapping the length calculation so resolveAddrs() reads up to 64 KiB past the heap buffer.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| libsidplayfp | libsidplayfp | up to 3.1.1 | — | No fix listed | CNA |
- libsidplayfp Vendorlibsidplayfp Affected up to 3.1.1 Fixed in — No fix listed CNA
Remediation
The sources list no fixed version for libsidplayfp.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Vendor assessments
Timeline
- 2026-10-16 Threatist record created from CVE-2026-111148
- 2026-10-16 Affected versions changed · Red Hat
- 2026-10-16 CVSS score added · Red Hat
References
Other 3
- https://github.com/libsidplayfp/libsidplayfp/blob/732fa8ec8131fc75aafc2eaea583ddcdeea2a3cc/src/sidtune/SidTuneBase.cpp#L295-L300
- https://github.com/libsidplayfp/libsidplayfp/blob/732fa8ec8131fc75aafc2eaea583ddcdeea2a3cc/src/sidtune/SidTuneBase.cpp#L488-L500
- https://github.com/libsidplayfp/libsidplayfp
Sources
- CVE-2026-111148 · CVE Program
- CVE-2026-111148 · NVD
- FIRST EPSS
- CVE-2026-111148 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences