Description
Furnace through 0.6.8.3 contains an out-of-bounds heap read vulnerability in DivEngine::loadFTM() in src/engine/fileOps/ftm.cpp, triggered by an unbounded DPCM note count during FamiTracker module import. Attackers can craft a .ftm, .dnm or 0CC/E-FamiTracker module with a 2A03 instrument note count above 120 to read past the noteMap array and crash Furnace when opened.
Published: 2026-10-26
Score: 6.8 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Immediate Patch
AI Analysis

Impact

Furnace through version 0.6.8.3 suffers an out-of-bounds heap read in the DivEngine::loadFTM() function. During import of a FamiTracker module, an unbounded DPCM note count can cause the application to read past the fixed-size noteMap array. The result is a crash of Furnace when a malicious file is opened, delivering a denial of service to whoever initiates the import.

Affected Systems

The affected product is Furnace by tildearrow. Versions up to and including 0.6.8.3 are vulnerable. All releases newer than 0.6.8.3 that contain the fix are considered safe.

Risk and Exploitability

The CVSS score of 6.8 places the flaw in the moderate severity range. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to supply a crafted .ftm, .dnm, or 0CC/E‑FamiTracker module and for the victim to open it locally or through user action. The outcome is an application crash; the read does not grant control or persistent compromise.

Generated by OpenCVE AI on October 27, 2026 at 08:12 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Furnace to a version newer than 0.6.8.3 that corrects the noteMap bounds check.
  • Avoid opening any .ftm, .dnm, or 0CC/E‑FamiTracker files from untrusted or unknown sources until a patch is applied.
  • Monitor the project’s GitHub for a fix and apply the patch as soon as it is released.

Generated by OpenCVE AI on October 27, 2026 at 08:12 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 27 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 27 Oct 2026 04:30:00 +0000

Type Values Removed Values Added
Description Furnace through 0.6.8.3 contains an out-of-bounds heap read vulnerability in DivEngine::loadFTM() in src/engine/fileOps/ftm.cpp, triggered by an unbounded DPCM note count during FamiTracker module import. Attackers can craft a .ftm, .dnm or 0CC/E-FamiTracker module with a 2A03 instrument note count above 120 to read past the noteMap array and crash Furnace when opened.
Title Furnace through 0.6.8.3 Out-of-Bounds Read via FamiTracker Module Import
First Time appeared Tildearrow
Tildearrow furnace
Weaknesses CWE-125
CPEs cpe:2.3:a:tildearrow:furnace:*:*:*:*:*:*:*:*
Vendors & Products Tildearrow
Tildearrow furnace
References
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'}

cvssV4_0

{'score': 6.8, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Tildearrow Furnace
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-27T14:17:14.912Z

Reserved: 2026-10-26T20:23:34.996Z

Link: CVE-2026-116730

cve-icon Vulnrichment

Updated: 2026-10-27T13:42:00.257Z

cve-icon NVD

Status : Deferred

Published: 2026-10-26T22:16:56.923

Modified: 2026-10-27T16:04:22.707

Link: CVE-2026-116730

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-27T08:15:15Z

Weaknesses