gbsplay through version 0.0.103 contains a heap out-of-bounds read in the function that processes VGM files. The flaw occurs when wait opcodes are present without a terminating byte, allowing the program to read beyond the allocated buffer. This can lead to a crash of the player, disrupting service on systems that rely on the tool.

The vulnerability is limited to the gbsplay utility from mmitch, specifically builds up to and including version 0.0.103. Any installation of that version on a host is susceptible, while newer releases are presumed patched.

The CVSS score of 4.8 indicates a moderate impact. EPSS is not available and the vulnerability is not listed in CISA KEV, suggesting limited public exploitation data. Attackers would need to supply a maliciously crafted VGM file; if an unauthenticated user can trigger the player, the risk escalates to a local denial of service. Without a known exploit, the likelihood is moderate but cannot be ruled out, especially in environments where arbitrary VGM files are processed.