6.1
MediumCVSS 3.1 · from VulnCheck
CVE-2026-116731
Furnace through 0.6.8.3 Out-of-Bounds Write via FamiTracker GROOVES Block Import
furnace · CWE-129 · CWE-129Affectedfurnace
FixA patch is linked in the references.
PublishedOct 26, 21:52 · VulnCheck
ScoredOct 26 · 6.1 · VulnCheck
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:10 UTC
What we know
No known exploitation. CISA KEV, checked 22:10 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker needs local access to the machine. CVSS: local.
Someone has to open, click or run something first. CVSS: user interaction required.
A successful attack can take the service down. CVSS impact.
Description
Furnace through 0.6.8.3 contains an out-of-bounds write vulnerability in DivEngine::loadFTM() that allows attackers to corrupt heap memory via an unchecked subsong index in the GROOVES block. Attackers can craft a FamiTracker module with a subsong count of 2 or more to write a groove pattern past the subsong vector, crashing Furnace when opened.
From VulnCheck
Affected and fixed versions
ProductAffectedFixed infurnaceup to 0.6.8.3–
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known