{
  "id": "security/c/CE-Programming__CEmu/2026-10-16-cert-field-get-length-overflow-oob-read",
  "title": "CEmu: integer overflow in the cert_field_get length check allows an out-of-bounds read on a crafted ROM",
  "category": "security",
  "type": "memory-safety",
  "severity": "medium",
  "ecosystem": "c",
  "project": {
    "owner": "CE-Programming",
    "repo": "CEmu",
    "url": "https://github.com/CE-Programming/CEmu"
  },
  "affected_versions": [
    "<= latest at review time (2026-10-16)"
  ],
  "status": "published",
  "summary": "cert_field_get in core/cert.c checked a certificate field's length with an addition that could overflow a 32-bit integer. With a very large field length, the sum wrapped around, the bounds check passed, and callers read far past the end of the ROM buffer. Loading a crafted TI calculator ROM could therefore cause an out-of-bounds read and crash the emulator (SEGV). The attack is local and needs the user to load the ROM.",
  "discovered_at": "2026-10-16T00:00:00+03:00",
  "updated_at": "2026-10-18T01:25:00+03:00",
  "public": true,
  "credit": "ucsurf",
  "disclosure": {
    "channel": "pvr",
    "ghsa_id": "GHSA-qfrc-22x5-wpfc",
    "cve_id": null,
    "url": "https://github.com/CE-Programming/CEmu/security/advisories/GHSA-qfrc-22x5-wpfc",
    "reported_at": "2026-10-16T11:35:54+03:00",
    "published_at": "2026-10-18T01:19:38+03:00"
  },
  "cvss": {
    "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L",
    "score": 4.4
  },
  "patched_versions": [],
  "pr": null
}