CVE-2026-116731: Furnace through 0.6.8.3 Out-of-Bounds Write via FamiTracker GROOVES Block Import
Furnace through 0.6.8.3 contains an out-of-bounds write vulnerability in DivEngine::loadFTM() that allows attackers to corrupt heap memory via an unchecked subsong index in the GROOVES block. Attackers can craft a FamiTracker module with a subsong count of 2 or more to write a groove pattern past the subsong vector, crashing Furnace when opened.
Affected Software
Event History
Frequently Asked Questions
What must an attacker provide to trigger the issue?
An attacker must induce a user to open a crafted FamiTracker module containing a GROOVES block with a subsong count of at least 2. The malformed module causes an unchecked subsong index to write a groove pattern beyond the subsong vector.
Is this remotely exploitable without user interaction?
No. The supplied vector is AV:L and UI:R, indicating local attack conditions and required user interaction. The affected Furnace instance must open the crafted module.
What is the observed impact when exploitation succeeds?
The out-of-bounds write corrupts heap memory and can crash Furnace. The provided impact vector indicates high availability impact and low integrity impact, with no confidentiality impact.
Which versions should be considered affected?
Furnace through version 0.6.8.3 is identified as affected. The available references include a commit that may be relevant for remediation, but no fixed release version is provided.