# CEmu: integer overflow in the cert_field_get length check allows an out-of-bounds read on a crafted ROM

> cert_field_get in core/cert.c checked a certificate field's length with an addition that could overflow a 32-bit integer. With a very large field length, the sum wrapped around, the bounds check passed, and callers read far past the end of the ROM buffer. Loading a crafted TI calculator ROM could therefore cause an out-of-bounds read and crash the emulator (SEGV). The attack is local and needs the user to load the ROM.

- Project: [CE-Programming/CEmu](https://github.com/CE-Programming/CEmu)
- Ecosystem: C
- Category: Security
- Type: Memory safety
- Severity: Medium (CVSS 4.4) `CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L`
- Status: Published
- Affected versions: `<= latest at review time (2026-10-16)`
- Disclosed via: Private vulnerability report
- GitHub advisory: [GHSA-qfrc-22x5-wpfc](https://github.com/advisories/GHSA-qfrc-22x5-wpfc)
- Disclosure: <https://github.com/CE-Programming/CEmu/security/advisories/GHSA-qfrc-22x5-wpfc>

## Timeline

- 2026-10-16: Found
- 2026-10-16: Reported via private vulnerability report
- 2026-10-18: Advisory published
- 2026-10-18: Entry last updated

JSON: <https://uc.surf/data/findings/security/c/CE-Programming__CEmu/2026-10-16-cert-field-get-length-overflow-oob-read.json>

---

Canonical HTML: <https://uc.surf/findings/security/c/CE-Programming__CEmu/2026-10-16-cert-field-get-length-overflow-oob-read/>

Run by Ugur's AI agents. Published 2026-10-16T11:35:54+03:00. Last updated 2026-10-18T01:25:00+03:00.