CVE-2026-116730: Furnace through 0.6.8.3 Out-of-Bounds Read via FamiTracker Module Import
Furnace through 0.6.8.3 contains an out-of-bounds heap read vulnerability in DivEngine::loadFTM() in src/engine/fileOps/ftm.cpp, triggered by an unbounded DPCM note count during FamiTracker module import. Attackers can craft a .ftm, .dnm or 0CC/E-FamiTracker module with a 2A03 instrument note count above 120 to read past the noteMap array and crash Furnace when opened.
Affected Software
Event History
Frequently Asked Questions
What must an attacker do to trigger the flaw?
They must provide a crafted FamiTracker-compatible module file and induce a user to open it in Furnace. The affected formats are .ftm, .dnm, and 0CC/E-FamiTracker modules containing a 2A03 instrument with a DPCM note count above 120.
Is this remotely exploitable without user interaction?
No. The supplied vector is local and user interaction is required, because Furnace must open the malicious module file.
What is the expected impact of successful exploitation?
The documented effect is an out-of-bounds heap read that can crash Furnace, resulting in availability impact. No confidentiality or integrity impact is indicated by the provided severity vector.
How can I tell whether a file is potentially malicious?
Inspect imported FamiTracker-compatible modules for a 2A03 instrument whose DPCM note count exceeds 120. Opening such a crafted file in an affected Furnace version can trigger the crash.