What’s Vulnerable › Vulnerabilities

CVE-2026-116730: Furnace through 0.6.8.3 Out-of-Bounds Read via FamiTracker Module Import

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-26 · updated 2026-10-27
• Weakness: CWE-125

Description

Furnace through 0.6.8.3 contains an out-of-bounds heap read vulnerability in DivEngine::loadFTM() in src/engine/fileOps/ftm.cpp, triggered by an unbounded DPCM note count during FamiTracker module import. Attackers can craft a .ftm, .dnm or 0CC/E-FamiTracker module with a 2A03 instrument note count above 120 to read past the noteMap array and crash Furnace when opened.

Affected products

• tildearrow Furnace: through 0.6.8.3

References

• https://github.com/tildearrow/furnace
• https://github.com/tildearrow/furnace/blob/v0.6.8.3/src/engine/fileOps/ftm.cpp#L981-L1017
• https://github.com/tildearrow/furnace/commit/c120c72391e3229fe258e5759f43427febcb8693
• https://github.com/tildearrow/furnace/issues/2966
• https://hackmd.io/@haindpwn/furnace-ftm-import-notemap-and-groove-subsong-oob
• https://www.vulncheck.com/advisories/furnace-through-0.6.8.3-out-of-bounds-read-via-famitracker-module-import

Get alerted when CVE-2026-116730 or the next vulnerability affects your stack