The vulnerability is a heap out‑of‑bounds read caused by an integer underflow in the track‑table bounds check within the AY loader. An attacker can provide a specially crafted ZXAYEMUL file that contains an oversized track table, causing the library to read memory beyond the allocated buffer when functions such as gme_track_info or gme_start_track are called. This read can lead to a crash of any application that consumes libgme, effectively causing a denial‑of‑service condition.

Game Music Emu (libgme) implementations up to and including version 0.6.5 are affected. This includes all builds that incorporate the libgme project before the bug‑fix commit. Systems using older releases that include the AY loader will be vulnerable.

The CVSS score of 6.8 indicates moderate severity. The EPSS value below 1% suggests a low likelihood of exploitation at present, and the issue is not listed in CISA’s KEV catalog. The attack likely requires an attacker to supply a malicious ZXAYEMUL file to a consumer of libgme; thus the vector is local or file‑based. If such a file is processed, the defect can crash the target application but does not expose sensitive data. Defensive measures should consider restricting file input or applying the patch promptly.