5.5
MediumCVSS 3.1 · from VulnCheck
CVE-2026-116730
Furnace through 0.6.8.3 Out-of-Bounds Read via FamiTracker Module Import
furnace · Out-of-bounds read · CWE-125Affectedfurnace
FixA patch is linked in the references.
PublishedOct 26, 21:52 · VulnCheck
ScoredOct 26 · 5.5 · VulnCheck
Exploit code publicNone known · checked 22:18 UTC
ExploitedNone known · CISA KEV checked 22:30 UTC
What we know
No known exploitation. CISA KEV, checked 22:30 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 22:18 UTC.
An attacker needs local access to the machine. CVSS: local.
Someone has to open, click or run something first. CVSS: user interaction required.
A successful attack can take the service down. CVSS impact.
Description
Furnace through 0.6.8.3 contains an out-of-bounds heap read vulnerability in DivEngine::loadFTM() in src/engine/fileOps/ftm.cpp, triggered by an unbounded DPCM note count during FamiTracker module import. Attackers can craft a .ftm, .dnm or 0CC/E-FamiTracker module with a 2A03 instrument note count above 120 to read past the noteMap array and crash Furnace when opened.
From VulnCheck
Affected and fixed versions
ProductAffectedFixed infurnaceup to 0.6.8.3–
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known