Out-of-Bounds Write Vulnerability in Furnace by tildearrow
CVE-2026-116731

6.9MEDIUM

Key Information:

Vendor

Tildearrow

Status
Furnace
Vendor
CVE Published:
26 October 2026

What is CVE-2026-116731?

Furnace, up to version 0.6.8.3, contains an out-of-bounds write vulnerability in the DivEngine::loadFTM() function. This flaw allows attackers to craft a malicious FamiTracker module with multiple subsongs, which could exploit unchecked subsong indexing in the GROOVES block. By exceeding the boundaries of the subsong vector, attackers can manipulate heap memory, leading to potential crashes or further exploitation when the compromised module is opened. This vulnerability underscores the importance of validating user-controlled input to prevent memory corruption risks.

Affected Version(s)

furnace 0 <= 0.6.8.3

References

https://github.com/tildearrow/furnace/issues/2966
issue-tracking
https://github.com/tildearrow/furnace
product
https://github.com/tildearrow/furnace/commit/c120c72391e3...
patch

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

HaiND from the Post and Telecommunication Institute of Technology
.