Out-of-Bounds Read Vulnerability in Furnace Product by Tildearrow
CVE-2026-116730
6.8MEDIUM
What is CVE-2026-116730?
Furnace, up to version 0.6.8.3, is susceptible to an out-of-bounds read vulnerability occurring in the DivEngine::loadFTM() function. This issue is triggered when importing FamiTracker modules that contain an excessive DPCM note count, specifically over 120 notes. If exploited, attackers can create a malicious .ftm, .dnm, or 0CC/E-FamiTracker module that leads to reading past the noteMap array, resulting in application crashes when such modules are loaded. Developers and users are advised to upgrade to newer versions and follow the security patches available on GitHub.
Affected Version(s)
furnace 0 <= 0.6.8.3
References
CVSS V4
Score:
6.8
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown
Timeline
Vulnerability published
Vulnerability Reserved
Credit
HaiND from the Post and Telecommunication Institute of Technology