10.0
CriticalCVSS 4.0 · from GovTech CSG
CVE-2026-24800
A heap-based buffer over-read or buffer overflow in tildearrow/furnace
furnace · Out-of-bounds write · CWE-787Affectedfurnace
FixUpdate to 0.6.8.3 or newer
PublishedJan 27, 08:33 · GovTech CSG
ScoredJan 27 · 10.0 · GovTech CSG
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:08 UTC
What we know
No known exploitation. CISA KEV, checked 22:08 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker only needs network access to the target. No login needed. CVSS: network, no privileges.
A successful attack can read and change data and take the service down. CVSS: high impact on confidentiality, integrity and availability.
A successful attack gives full control of the affected system. CISA: technical impact total.
Description
Out-of-bounds Write, Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in tildearrow furnace (extern/zlib modules). This vulnerability is associated with program files inflate.C.
From GovTech CSG
Affected and fixed versions
ProductAffectedFixed infurnacebefore 0.6.8.30.6.8.3
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known