CVE-2026-116730
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
Furnace through 0.6.8.3 contains an out-of-bounds heap read vulnerability in DivEngine::loadFTM() in src/engine/fileOps/ftm.cpp, triggered by an unbounded DPCM note count during FamiTracker module import. Attackers can craft a .ftm, .dnm or 0CC/E-FamiTracker module with a 2A03 instrument note count above 120 to read past the noteMap array and crash Furnace when opened.
Risk Assessment
Heap memory data leakage or Furnace application crashes may occur. Organizations using Furnace to process untrusted modules are exposed to information disclosure and service interruption.
Recommendation
Update Furnace to a version newer than 0.6.8.3 if available, or apply the vendor patch. Avoid opening untrusted FamiTracker modules until updated.
Other vulnerabilities in Furnace
See all- CVE-2026-4732High
Out-of-bounds Read vulnerability in tildearrow furnace (extern/libsndfile-modified/src modules), associated with flac.C.
- CVE-2026-24800Critical
Classic buffer overflow (out-of-bounds write) vulnerability in the furnace project (zlib modules) related to inflate.C files.
- CVE-2026-116731Medium
Furnace through 0.6.8.3 contains an out-of-bounds write vulnerability in DivEngine::loadFTM() that allows attackers to corrupt heap memory via an unchecked subsong index in the GROOVES block. Attackers can craft a FamiTracker module with a subsong count of 2 or more to write a groove pattern past the subsong vector, crashing Furnace when opened.
Original NVD description (English source)
Furnace through 0.6.8.3 contains an out-of-bounds heap read vulnerability in DivEngine::loadFTM() in src/engine/fileOps/ftm.cpp, triggered by an unbounded DPCM note count during FamiTracker module import. Attackers can craft a .ftm, .dnm or 0CC/E-FamiTracker module with a 2A03 instrument note count above 120 to read past the noteMap array and crash Furnace when opened.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS