Snes9x UPS patch file out-of-bounds heap write via unbounded relative offset in ReadUPSPatch

#Requires -Version 5.1
<#
  Check-CVE-2026-39199.ps1
  Detects whether snes9x 1.52-1.63 is present on this host.
  Output: VULNERABLE / PATCHED / UNKNOWN
  Exit codes: 1 = VULNERABLE, 0 = PATCHED, 2 = UNKNOWN
#>

$found = $false
$vulnerable = $false

# Check common install paths and running processes
$searchPaths = @(
    "$env:ProgramFiles\Snes9x",
    "${env:ProgramFiles(x86)}\Snes9x",
    "$env:LOCALAPPDATA\Snes9x",
    "$env:APPDATA\Snes9x",
    "$env:USERPROFILE\Downloads\snes9x*",
    "$env:USERPROFILE\Desktop\snes9x*"
)

# Also check if snes9x is running
$procs = Get-Process -Name 'snes9x*' -ErrorAction SilentlyContinue
if ($procs) {
    Write-Host "[!] snes9x process is currently running: $($procs.Path -join ', ')"
    $found = $true
    $vulnerable = $true
}

# Search filesystem
foreach ($p in $searchPaths) {
    $exes = Get-ChildItem -Path $p -Filter 'snes9x*.exe' -Recurse -ErrorAction SilentlyContinue
    foreach ($exe in $exes) {
        $found = $true
        $ver = $exe.VersionInfo.ProductVersion
        Write-Host "[*] Found snes9x at: $($exe.FullName) (version: $ver)"
        # snes9x versions 1.52 through 1.63 are vulnerable
        if ($ver -match '^1\.(5[2-9]|6[0-3])') {
            $vulnerable = $true
            Write-Host "[!] Version $ver is in the vulnerable range (1.52-1.63)"
        } elseif ($ver) {
            Write-Host "[+] Version $ver may be outside the vulnerable range"
        } else {
            Write-Host "[?] Could not determine version — assuming vulnerable if v1.63 era"
            $vulnerable = $true
        }
    }
}

# Check snap/scoop/winget
try {
    $wingetList = winget list --name snes9x 2>$null
    if ($wingetList -match 'snes9x') {
        Write-Host "[*] snes9x found via winget"
        $found = $true
        $vulnerable = $true
    }
} catch { }

if (-not $found) {
    Write-Host "PATCHED — snes9x not found on this host."
    exit 0
} elseif ($vulnerable) {
    Write-Host "VULNERABLE — snes9x 1.52-1.63 detected. Remove as unauthorized software."
    exit 1
} else {
    Write-Host "UNKNOWN — snes9x found but version could not be confirmed."
    exit 2
}