Snes9X 1.63 is vulnerable to an out‑of‑bounds write that can be triggered by a specially crafted .ups file. The defect occurs when the emulator parses the file’s data fields, allowing the write to extend beyond the allocated buffer. This memory corruption leads to a crash of the application, resulting in a denial of service. The weakness is identified as Dangerous Out‑of‑Bounds Write (CWE‑787) and does not provide code execution or data disclosure.

Affected systems include any installation of Snes9X 1.63. The vulnerability arises from the emulator’s handling of .ups patch files, so users running this exact version on Windows, macOS, or Linux are at risk. No other versions or releases are currently identified as affected.

The CVSS score of 2.9 categorizes the flaw as low severity, and the EPSS value of < 1% indicates a very low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is local, requiring a user to supply a malicious .ups file to the emulator; remote exploitation is not described. An attacker could crash the emulator during use, causing interruption of the user’s activity but no compromise of system integrity or data.