Heap Out-of-Bounds Read in libsidplayfp

Executive Summary

CVE-2026-111148 is a heap out-of-bounds read vulnerability in libsidplayfp through version 3.1.1. It occurs when processing malformed PSID or RSID music files where the data offset in the header exceeds the actual file size. This causes resolveAddrs() to read up to 64 KiB past the allocated heap buffer, potentially crashing applications.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor applications using libsidplayfp for crashes when processing SID music files. Use tools like AddressSanitizer to identify heap out-of-bounds reads during file parsing. Inspect log files for segmentation faults or memory access violations when loading malformed PSID/RSID files.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause applications using libsidplayfp to crash or experience denial-of-service conditions when processing specially crafted SID music files. While it does not directly enable code execution, it may lead to instability in media players, song-length scanners, or other tools that rely on libsidplayfp for SID file parsing.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability does not directly impact compliance with GDPR, HIPAA, or similar standards. It primarily causes application crashes or denial-of-service conditions by triggering heap out-of-bounds reads in libsidplayfp when processing malformed SID music files. No evidence suggests data exposure, unauthorized access, or privacy violations that would violate these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update libsidplayfp to the latest version beyond 3.1.1. If updating is not possible, restrict access to applications using libsidplayfp to trusted users and files. Implement file validation to reject SID files with suspicious header data offsets before processing.

Useful 0 Not Useful 0