CVE-2026-111148

Name	CVE-2026-111148
Description	libsidplayfp through 3.1.1 contains a heap out-of-bounds read vulnerability that allows attackers to crash applications by supplying a PSID/RSID file with an unchecked data offset. Attackers can set the header data offset beyond the file size, wrapping the length calculation so resolveAddrs() reads up to 64 KiB past the heap buffer.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
libsidplayfp (PTS)	bookworm	2.4.2-1	vulnerable
	trixie	2.12.0-1	vulnerable
	forky, sid	2.16.1-1	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
libsidplayfp	source	experimental	3.1.2-1
libsidplayfp	source	(unstable)	(unfixed)

Notes

[trixie] - libsidplayfp <no-dsa> (Minor issue)
[bookworm] - libsidplayfp <postponed> (Minor issue)
https://github.com/libsidplayfp/libsidplayfp/issues/280
https://github.com/libsidplayfp/libsidplayfp/commit/afa48cda489ad3a7c5ad12b635632f160599add8 (v3.1.2)