Game Music Emu (libgme) through version 0.6.5 contains a vulnerability in the Classic_Emu::mute_voices_ function that performs an out‑of‑bounds read. The read occurs when the library processes NSF files whose voice count exceeds the 16‑entry voice‑type table. This bug leads to a crash of any application that loads such a file, resulting in a denial of service. The weakness is classified as CWE‑125, an out‑of‑bounds read flaw that compromises application stability.

The affected product is libgme:game‑music‑emu, the Game Music Emu library. Versions up to and including 0.6.5 are vulnerable. Proprietary or derivative builds that embed the unpatched library are also impacted.

The CVSS score of 6.8 indicates medium severity. An attacker can craft a malicious NSF header with chip_flags 0x3F and supply the file to any instance that calls gme_open_data or gme_open_file. The EPSS score is less than 1 %, suggesting a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, meaning no widespread, confirmed exploitation has been reported. The primary vector is local or remote file delivery, so any user capable of providing a crafted NSF file to the target application can trigger the crash. Because of the low exploitation probability and dependence on file handling, the risk is moderate but should be mitigated promptly.