CVE-2026-116730— Furnace through 0.6.8.3 Out-of-Bounds Read via FamiTracker Module Import

Quick assessment

Affected

tildearrow furnace

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Furnace 0.6.8.3 及更早版本在的函数中存在一个越界堆读取漏洞。该漏洞在导入 FamiTracker 模块时，因 DPCM 音符数量无限制而被触发。攻击者可构造包含 2A03 乐器音符数量超过 120 的、或 0CC/E-FamiTracker 模块，导致在打开时读取数组之外的数据，进而引发 Furnace 崩溃。

CVSS 5.5 · Medium Updated Oct 27, 2026

Possible ATT&CK Techniques 1 AI

T1203 · Exploitation for Client Execution

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Furnace through 0.6.8.3 Out-of-Bounds Read via FamiTracker Module Import

Source: CVE Program / CVE List V5

Vulnerability Description

Furnace through 0.6.8.3 contains an out-of-bounds heap read vulnerability in DivEngine::loadFTM() in src/engine/fileOps/ftm.cpp, triggered by an unbounded DPCM note count during FamiTracker module import. Attackers can craft a .ftm, .dnm or 0CC/E-FamiTracker module with a 2A03 instrument note count above 120 to read past the noteMap array and crash Furnace when opened.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

跨界内存读

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
tildearrow	furnace	0 ~ 0.6.8.3	-

II. Public POCs for CVE-2026-116730

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-116730

请登录查看更多情报信息。

Other References for CVE-2026-116730 (6)

https://hackmd.io/@haindpwn/furnace-ftm-import-notemap-and-groove-subsong-oob third-party-advisory
https://github.com/tildearrow/furnace/commit/c120c72391e3229fe258e5759f43427febcb8693 patch
https://github.com/tildearrow/furnace/blob/v0.6.8.3/src/engine/fileOps/ftm.cpp#L981-L1017 technical-description
https://github.com/tildearrow/furnace product
https://github.com/tildearrow/furnace/issues/2966 issue-tracking
https://www.vulncheck.com/advisories/furnace-through-0.6.8.3-out-of-bounds-read-via-famitracker-module-import third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-116730

IV. Related Vulnerabilities

Same product: furnace

Same vendor: tildearrow

Same weakness: CWE-125