An out-of-bounds read can occur in Furnace's modified libsndfile source code that processes FLAC files. The flaw allows the program to access memory beyond a buffer boundary, potentially revealing sensitive data or causing a crash. This weakness is a classic buffer over-read (CWE-125).

The vulnerability affects the Furnace project maintained by tildearrow. All releases prior to version 0.7 are impacted. Users running these older versions and handling FLAC audio are at risk because the flaw is tied to the flac.C module.

The CVSS score of 8.4 indicates a high severity level, and the EPSS data is unavailable. The issue is not listed in the CISA Known Exploited Vulnerabilities catalog. Based on the description, it is inferred that an attacker who can supply a crafted FLAC file to a system running an affected installation could trigger the out-of-bounds read and obtain sensitive information or cause a denial of service. The problem is fully mitigated by upgrading to version 0.7 or later.