CVE-2026-116730 Details
Description
Furnace through 0.6.8.3 contains an out-of-bounds heap read vulnerability in DivEngine::loadFTM() in src/engine/fileOps/ftm.cpp, triggered by an unbounded DPCM note count during FamiTracker module import. Attackers can craft a .ftm, .dnm or 0CC/E-FamiTracker module with a 2A03 instrument note count above 120 to read past the noteMap array and crash Furnace when opened.
A heap-based out-of-bounds read vulnerability has been identified in the FamiTracker module importer of Furnace versions through 0.6.8.3. This vulnerability is triggered by an unbounded DPCM note count in 2A03 instruments, allowing attackers to craft FamiTracker modules that, when imported, read past the allocated noteMap array. The issue causes Furnace to crash upon opening the manipulated module.
Users can update to Furnace version 0.6.8.4 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 26, 2026CISA-ADP
Assessed Oct 27, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/tildearrow/furnace | [email protected] | Vendor |
| https://github.com/tildearrow/furnace/blob/v0.6.8.3/src/engine/fileOps/ftm.cpp#L981-L1017 | [email protected] | Source CodeVendor |
| https://github.com/tildearrow/furnace/commit/c120c72391e3229fe258e5759f43427febcb8693 | [email protected] | Source CodeVendor |
| https://github.com/tildearrow/furnace/issues/2966 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://hackmd.io/@haindpwn/furnace-ftm-import-notemap-and-groove-subsong-oob | [email protected] | BundleExploitRemedyTechnical Analysis |
| https://www.vulncheck.com/advisories/furnace-through-0.6.8.3-out-of-bounds-read-via-famitracker-module-import | [email protected] | AdvisoryBundleRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-125 | Out-of-bounds Read | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Furnace | <= 0.6.8.3 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 27, 2026 | CVE Modified | CISA-ADP |
| Oct 26, 2026 | New CVE Received | [email protected] |