The vulnerability is an out-of-bounds write in the DivEngine::loadFTM() function of Furnace. An unchecked subsong index in the GROOVES block allows a crafted FamiTracker module file to write a groove pattern beyond the bounds of the subsong vector, corrupting heap memory and causing the application to crash. This flaw constitutes a medium severity heap corruption vulnerability, identified as CWE‑129, that results in denial‑of‑service conditions when a malicious file is processed.

Affected systems are users of tildearrow’s Furnace version 0.6.8.3. The vulnerability is present when loading FamiTracker module files (.FTM) that contain at least two subsongs, which is the minimum required to trigger the out‑of‑bounds write. No other versions are listed as affected in the official data.

Risk assessment shows a CVSS score of 6.9, indicating medium impact. EPSS is not available, and the issue is not listed in CISA’s KEV catalog. Exploitation requires an attacker to supply a malicious module file to a user who opens it locally, so the attack vector is local file handling. Given the lack of known remote exploitation paths, the threat is confined to users who load tampered files, but the impact can be severe if a privileged user runs Furnace with the crafted input. Therefore, the overall risk is moderate, with an emphasis on preventing the opening of untrusted files and applying the vendor‑issued fix.