The vulnerability is a classic buffer overflow caused by an out‑of‑bounds write in the inflate.C module of the Furnace project, which uses external zlib. The overflow happens during a buffer copy that does not verify the size of the input, allowing an attacker to overwrite adjacent heap memory. This can corrupt program state and, if successfully abused, lead to arbitrary code execution or denial of service. The weakness aligns with CWE-120 and CWE-787.

The affected product is Furnace by tildearrow. All deployments of Furnace that include the zlib inflate.C implementation prior to the fix introduced in pull request 2471 are vulnerable. No specific version range is listed; the issue is tied to the code present before that PR.

The CVSS score is 10, indicating maximum severity. The EPSS is less than 1%, suggesting very low exploitation probability currently, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be remote, as an adversary can craft a malicious compressed stream sent to a process that will parse it. Successful exploitation would require the target running the vulnerable version of Furnace and the ability to supply the crafted input, making the condition a simple remote injection. Given the high score but low EPSS, the risk remains high for targeted or pre‑planned attacks, and it is prudent to remediate promptly.