UBUNTU-CVE-2026-116731: Medium severity ubuntu/furnace vulnerability
Furnace through 0.6.8.3 contains an out-of-bounds write vulnerability in DivEngine::loadFTM() that allows attackers to corrupt heap memory via an unchecked subsong index in the GROOVES block. Attackers can craft a FamiTracker module with a subsong count of 2 or more to write a groove pattern past the subsong vector, crashing Furnace when opened.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users who open attacker-controlled FamiTracker module files in Furnace are exposed. The vulnerable code is present in Furnace through version 0.6.8.3.
What must an attacker provide to trigger the vulnerability?
An attacker must craft a FamiTracker module whose GROOVES block uses an unchecked subsong index, with a subsong count of at least 2. The issue is triggered when Furnace opens the malicious module.
What is the likely impact of successful exploitation?
The crafted file can cause an out-of-bounds heap write by writing a groove pattern past the subsong vector. The documented outcome is a crash of Furnace; the supplied data does not establish further impact.