Out-of-Bounds Write Vulnerability in Tildearrow Furnace Product
CVE-2026-24800

10CRITICAL

Key Information:

Vendor

Tildearrow

Status
Furnace
Vendor
CVE Published:
27 January 2026

What is CVE-2026-24800?

A vulnerability in the Tildearrow Furnace product allows for an out-of-bounds write due to improper handling of buffer sizes within the inflate.C module of the associated zlib modules. This flaw can lead to unexpected behavior and potential exploitation, making it critical to address through timely patching.

Affected Version(s)

furnace 0 < 0.6.8.3

References

https://github.com/tildearrow/furnace/pull/2471
patch

CVSS V4

Score:
10
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

TITAN Team (titancaproject@gmail.com)
.