CVE-2026-4732
HighSummary
Out-of-bounds Read vulnerability in tildearrow furnace (extern/libsndfile-modified/src modules), associated with flac.C.
Risk Assessment
May lead to information disclosure or program crash when processing specially crafted FLAC files.
Recommendation
Update furnace to version 0.7 or later.
Other vulnerabilities in furnace
See all- CVE-2026-24800Critical
Classic buffer overflow (out-of-bounds write) vulnerability in the furnace project (zlib modules) related to inflate.C files.
- CVE-2026-116731Medium
Furnace through 0.6.8.3 contains an out-of-bounds write vulnerability in DivEngine::loadFTM() that allows attackers to corrupt heap memory via an unchecked subsong index in the GROOVES block. Attackers can craft a FamiTracker module with a subsong count of 2 or more to write a groove pattern past the subsong vector, crashing Furnace when opened.
- CVE-2026-116730Medium
Furnace through 0.6.8.3 contains an out-of-bounds heap read vulnerability in DivEngine::loadFTM() in src/engine/fileOps/ftm.cpp, triggered by an unbounded DPCM note count during FamiTracker module import. Attackers can craft a .ftm, .dnm or 0CC/E-FamiTracker module with a 2A03 instrument note count above 120 to read past the noteMap array and crash Furnace when opened.
Original NVD description (English source)
Out-of-bounds Read vulnerability in tildearrow furnace (extern/libsndfile-modified/src modules). This vulnerability is associated with program files flac.C. This issue affects furnace: before 0.7.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS