CVE-2026-116731
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
Furnace through 0.6.8.3 contains an out-of-bounds write vulnerability in DivEngine::loadFTM() that allows attackers to corrupt heap memory via an unchecked subsong index in the GROOVES block. Attackers can craft a FamiTracker module with a subsong count of 2 or more to write a groove pattern past the subsong vector, crashing Furnace when opened.
Risk Assessment
Heap memory corruption and Furnace application crashes may occur, potentially leading to code execution or disruption. Organizations using Furnace to process untrusted modules are exposed.
Recommendation
Update Furnace to a version newer than 0.6.8.3 if available, or apply the vendor patch. Avoid opening untrusted FamiTracker modules until updated.
Other vulnerabilities in Furnace
See all- CVE-2026-4732High
Out-of-bounds Read vulnerability in tildearrow furnace (extern/libsndfile-modified/src modules), associated with flac.C.
- CVE-2026-24800Critical
Classic buffer overflow (out-of-bounds write) vulnerability in the furnace project (zlib modules) related to inflate.C files.
- CVE-2026-116730Medium
Furnace through 0.6.8.3 contains an out-of-bounds heap read vulnerability in DivEngine::loadFTM() in src/engine/fileOps/ftm.cpp, triggered by an unbounded DPCM note count during FamiTracker module import. Attackers can craft a .ftm, .dnm or 0CC/E-FamiTracker module with a 2A03 instrument note count above 120 to read past the noteMap array and crash Furnace when opened.
Original NVD description (English source)
Furnace through 0.6.8.3 contains an out-of-bounds write vulnerability in DivEngine::loadFTM() that allows attackers to corrupt heap memory via an unchecked subsong index in the GROOVES block. Attackers can craft a FamiTracker module with a subsong count of 2 or more to write a groove pattern past the subsong vector, crashing Furnace when opened.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS