8.4
HighCVSS 4.0 · from GovTech CSG
CVE-2026-4732
Out-of-bounds Read Overflow in tildearrow/furnace
furnace · Out-of-bounds read · CWE-125Affectedfurnace
FixUpdate to 0.7 or newer
PublishedMar 24, 02:50 · GovTech CSG
ScoredMar 24 · 8.4 · GovTech CSG
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:08 UTC
What we know
No known exploitation. CISA KEV, checked 22:08 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker needs local access to the machine. CVSS: local.
Someone has to open, click or run something first. CVSS: user interaction required.
A successful attack can read and change data and take the service down. CVSS: high impact on confidentiality, integrity and availability.
A successful attack gives full control of the affected system. CISA: technical impact total.
Description
Out-of-bounds Read vulnerability in tildearrow furnace (extern/libsndfile-modified/src modules). This vulnerability is associated with program files flac.C. This issue affects furnace: before 0.7.
From GovTech CSG
Affected and fixed versions
ProductAffectedFixed infurnacebefore 0.70.7
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known