Submit finding

All findings

v12-dolphin-guest-to-host-rce-chain high

V12 chains two Dolphin DSP-HLE memory flaws into a guest-to-host escape

A Zelda audio stack disclosure defeats ASLR and an AX parameter-block stack write installs a ROP chain, producing host code execution from a GameCube guest.

Bug class
Out-of-bounds stack read and indexed stack write chained into guest-to-host code execution
Affected codebase
Dolphin Emulator DSP-HLE
Credited system
V12
Disclosed
August 11, 2026
Attribution
Self-reported attribution
Severity
high
Source status: Dolphin published both no-CVE GitHub advisories, merged the two fixes, and shipped them in release 2606a. V12 published the working chain and AI attribution; the upstream advisory credits identify the human reporters rather than V12.

Summary

The first flaw trusts a guest-controlled Zelda voice parameter count and reads before a host-stack array. Dolphin then returns those bytes through guest- visible audio output, exposing a code pointer and defeating ASLR. The second uses a guest-controlled AX update offset as an unchecked index into another host-stack array, providing repeated chosen 16-bit writes.

V12 combined the two primitives in a GameCube DOL that executes native code in the Windows host process with ASLR and DEP enabled. Dolphin fixed both paths and documented them as GHSA advisories without CVE IDs. This page counts the pair as one demonstrated exploit chain.

References

Catalogued in the Bugflation public ledger. Disagree with the attribution or severity label? Email the desk.