Read the docs
TI-2022-01173 Aliases CVE-2022-1289GHSA-j9m2-4gfx-jq57

tildearrow Furnace Incomplete Fix CVE-2022-1211 denial of service

Priority MEDIUM 62CWE-404Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-404.

Summary

A denial of service vulnerability was found in tildearrow Furnace. It has been classified as problematic. This is due to an incomplete fix of CVE-2022-1211. It is possible to initiate the attack remotely but it requires user interaction. The issue got fixed with the patch 0eb02422d5161767e9983bdaa5c429762d3477ce.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.01155 67th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
tildearrowFurnaceall versions—No fix listedCNA
  • Furnace Vendortildearrow Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 50

CPEVersionsRoleVendor
cpe:2.3:a:tildearrow:furnace:-:*:*:*:*:*:*:*not specified by NVDVulnerabletildearrow
cpe:2.3:a:tildearrow:furnace:0.2:*:*:*:*:*:*:*0.2Vulnerabletildearrow
cpe:2.3:a:tildearrow:furnace:0.2.1:*:*:*:*:*:*:*0.2.1Vulnerabletildearrow
cpe:2.3:a:tildearrow:furnace:0.2.2:*:*:*:*:*:*:*0.2.2Vulnerabletildearrow
cpe:2.3:a:tildearrow:furnace:0.3:*:*:*:*:*:*:*0.3Vulnerabletildearrow
cpe:2.3:a:tildearrow:furnace:0.3.1:*:*:*:*:*:*:*0.3.1Vulnerabletildearrow
cpe:2.3:a:tildearrow:furnace:0.4:*:*:*:*:*:*:*0.4Vulnerabletildearrow
cpe:2.3:a:tildearrow:furnace:0.4.1:*:*:*:*:*:*:*0.4.1Vulnerabletildearrow
cpe:2.3:a:tildearrow:furnace:0.4.2:*:*:*:*:*:*:*0.4.2Vulnerabletildearrow
cpe:2.3:a:tildearrow:furnace:0.4.3:*:*:*:*:*:*:*0.4.3Vulnerabletildearrow
  • cpe:2.3:a:tildearrow:furnace:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·tildearrow
  • cpe:2.3:a:tildearrow:furnace:0.2:*:*:*:*:*:*:* Versions 0.2 Vulnerable ·tildearrow
  • cpe:2.3:a:tildearrow:furnace:0.2.1:*:*:*:*:*:*:* Versions 0.2.1 Vulnerable ·tildearrow
  • cpe:2.3:a:tildearrow:furnace:0.2.2:*:*:*:*:*:*:* Versions 0.2.2 Vulnerable ·tildearrow
  • cpe:2.3:a:tildearrow:furnace:0.3:*:*:*:*:*:*:* Versions 0.3 Vulnerable ·tildearrow
  • cpe:2.3:a:tildearrow:furnace:0.3.1:*:*:*:*:*:*:* Versions 0.3.1 Vulnerable ·tildearrow
  • cpe:2.3:a:tildearrow:furnace:0.4:*:*:*:*:*:*:* Versions 0.4 Vulnerable ·tildearrow
  • cpe:2.3:a:tildearrow:furnace:0.4.1:*:*:*:*:*:*:* Versions 0.4.1 Vulnerable ·tildearrow
  • cpe:2.3:a:tildearrow:furnace:0.4.2:*:*:*:*:*:*:* Versions 0.4.2 Vulnerable ·tildearrow
  • cpe:2.3:a:tildearrow:furnace:0.4.3:*:*:*:*:*:*:* Versions 0.4.3 Vulnerable ·tildearrow
Show 40 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:tildearrow:furnace:0.4.4:*:*:*:*:*:*:*0.4.4Vulnerabletildearrow
cpe:2.3:a:tildearrow:furnace:0.4.5:*:*:*:*:*:*:*0.4.5Vulnerabletildearrow
cpe:2.3:a:tildearrow:furnace:0.4.5:real:*:*:*:*:*:*0.4.5 realVulnerabletildearrow
cpe:2.3:a:tildearrow:furnace:0.4.6:*:*:*:*:*:*:*0.4.6Vulnerabletildearrow
cpe:2.3:a:tildearrow:furnace:0.4.7:*:*:*:*:*:*:*0.4.7Vulnerabletildearrow
cpe:2.3:a:tildearrow:furnace:0.5:*:*:*:*:*:*:*0.5Vulnerabletildearrow
cpe:2.3:a:tildearrow:furnace:0.5.1:*:*:*:*:*:*:*0.5.1Vulnerabletildearrow
cpe:2.3:a:tildearrow:furnace:0.5.2:*:*:*:*:*:*:*0.5.2Vulnerabletildearrow
cpe:2.3:a:tildearrow:furnace:0.5.3:*:*:*:*:*:*:*0.5.3Vulnerabletildearrow
cpe:2.3:a:tildearrow:furnace:0.5.4:*:*:*:*:*:*:*0.5.4Vulnerabletildearrow
cpe:2.3:a:tildearrow:furnace:0.5.5:*:*:*:*:*:*:*0.5.5Vulnerabletildearrow
cpe:2.3:a:tildearrow:furnace:0.5.6:*:*:*:*:*:*:*0.5.6Vulnerabletildearrow
cpe:2.3:a:tildearrow:furnace:0.5.7:-:*:*:*:*:*:*0.5.7Vulnerabletildearrow
cpe:2.3:a:tildearrow:furnace:0.5.7:pre4:*:*:*:*:*:*0.5.7 pre4Vulnerabletildearrow
cpe:2.3:a:tildearrow:furnace:0.5.8:*:*:*:*:*:*:*0.5.8Vulnerabletildearrow
cpe:2.3:a:tildearrow:furnace:0.6:pre0:*:*:*:*:*:*0.6 pre0Vulnerabletildearrow
cpe:2.3:a:tildearrow:furnace:dev5:*:*:*:*:*:*:*dev5Vulnerabletildearrow
cpe:2.3:a:tildearrow:furnace:dev6:*:*:*:*:*:*:*dev6Vulnerabletildearrow
cpe:2.3:a:tildearrow:furnace:dev7:*:*:*:*:*:*:*dev7Vulnerabletildearrow
cpe:2.3:a:tildearrow:furnace:dev8:*:*:*:*:*:*:*dev8Vulnerabletildearrow
cpe:2.3:a:tildearrow:furnace:dev9:*:*:*:*:*:*:*dev9Vulnerabletildearrow
cpe:2.3:a:tildearrow:furnace:dev10:*:*:*:*:*:*:*dev10Vulnerabletildearrow
cpe:2.3:a:tildearrow:furnace:dev62:*:*:*:*:*:*:*dev62Vulnerabletildearrow
cpe:2.3:a:tildearrow:furnace:dev63:*:*:*:*:*:*:*dev63Vulnerabletildearrow
cpe:2.3:a:tildearrow:furnace:dev64:*:*:*:*:*:*:*dev64Vulnerabletildearrow
cpe:2.3:a:tildearrow:furnace:dev65:*:*:*:*:*:*:*dev65Vulnerabletildearrow
cpe:2.3:a:tildearrow:furnace:dev66:*:*:*:*:*:*:*dev66Vulnerabletildearrow
cpe:2.3:a:tildearrow:furnace:dev67:*:*:*:*:*:*:*dev67Vulnerabletildearrow
cpe:2.3:a:tildearrow:furnace:dev68:*:*:*:*:*:*:*dev68Vulnerabletildearrow
cpe:2.3:a:tildearrow:furnace:dev69:*:*:*:*:*:*:*dev69Vulnerabletildearrow
cpe:2.3:a:tildearrow:furnace:dev70:*:*:*:*:*:*:*dev70Vulnerabletildearrow
cpe:2.3:a:tildearrow:furnace:dev71:*:*:*:*:*:*:*dev71Vulnerabletildearrow
cpe:2.3:a:tildearrow:furnace:dev72:*:*:*:*:*:*:*dev72Vulnerabletildearrow
cpe:2.3:a:tildearrow:furnace:dev73:*:*:*:*:*:*:*dev73Vulnerabletildearrow
cpe:2.3:a:tildearrow:furnace:dev75:*:*:*:*:*:*:*dev75Vulnerabletildearrow
cpe:2.3:a:tildearrow:furnace:dev76:*:*:*:*:*:*:*dev76Vulnerabletildearrow
cpe:2.3:a:tildearrow:furnace:dev77:*:*:*:*:*:*:*dev77Vulnerabletildearrow
cpe:2.3:a:tildearrow:furnace:dev78:*:*:*:*:*:*:*dev78Vulnerabletildearrow
cpe:2.3:a:tildearrow:furnace:dev79:*:*:*:*:*:*:*dev79Vulnerabletildearrow
cpe:2.3:a:tildearrow:furnace:dev80:*:*:*:*:*:*:*dev80Vulnerabletildearrow
  • cpe:2.3:a:tildearrow:furnace:0.4.4:*:*:*:*:*:*:* Versions 0.4.4 Vulnerable ·tildearrow
  • cpe:2.3:a:tildearrow:furnace:0.4.5:*:*:*:*:*:*:* Versions 0.4.5 Vulnerable ·tildearrow
  • cpe:2.3:a:tildearrow:furnace:0.4.5:real:*:*:*:*:*:* Versions 0.4.5 real Vulnerable ·tildearrow
  • cpe:2.3:a:tildearrow:furnace:0.4.6:*:*:*:*:*:*:* Versions 0.4.6 Vulnerable ·tildearrow
  • cpe:2.3:a:tildearrow:furnace:0.4.7:*:*:*:*:*:*:* Versions 0.4.7 Vulnerable ·tildearrow
  • cpe:2.3:a:tildearrow:furnace:0.5:*:*:*:*:*:*:* Versions 0.5 Vulnerable ·tildearrow
  • cpe:2.3:a:tildearrow:furnace:0.5.1:*:*:*:*:*:*:* Versions 0.5.1 Vulnerable ·tildearrow
  • cpe:2.3:a:tildearrow:furnace:0.5.2:*:*:*:*:*:*:* Versions 0.5.2 Vulnerable ·tildearrow
  • cpe:2.3:a:tildearrow:furnace:0.5.3:*:*:*:*:*:*:* Versions 0.5.3 Vulnerable ·tildearrow
  • cpe:2.3:a:tildearrow:furnace:0.5.4:*:*:*:*:*:*:* Versions 0.5.4 Vulnerable ·tildearrow
  • cpe:2.3:a:tildearrow:furnace:0.5.5:*:*:*:*:*:*:* Versions 0.5.5 Vulnerable ·tildearrow
  • cpe:2.3:a:tildearrow:furnace:0.5.6:*:*:*:*:*:*:* Versions 0.5.6 Vulnerable ·tildearrow
  • cpe:2.3:a:tildearrow:furnace:0.5.7:-:*:*:*:*:*:* Versions 0.5.7 Vulnerable ·tildearrow
  • cpe:2.3:a:tildearrow:furnace:0.5.7:pre4:*:*:*:*:*:* Versions 0.5.7 pre4 Vulnerable ·tildearrow
  • cpe:2.3:a:tildearrow:furnace:0.5.8:*:*:*:*:*:*:* Versions 0.5.8 Vulnerable ·tildearrow
  • cpe:2.3:a:tildearrow:furnace:0.6:pre0:*:*:*:*:*:* Versions 0.6 pre0 Vulnerable ·tildearrow
  • cpe:2.3:a:tildearrow:furnace:dev5:*:*:*:*:*:*:* Versions dev5 Vulnerable ·tildearrow
  • cpe:2.3:a:tildearrow:furnace:dev6:*:*:*:*:*:*:* Versions dev6 Vulnerable ·tildearrow
  • cpe:2.3:a:tildearrow:furnace:dev7:*:*:*:*:*:*:* Versions dev7 Vulnerable ·tildearrow
  • cpe:2.3:a:tildearrow:furnace:dev8:*:*:*:*:*:*:* Versions dev8 Vulnerable ·tildearrow
  • cpe:2.3:a:tildearrow:furnace:dev9:*:*:*:*:*:*:* Versions dev9 Vulnerable ·tildearrow
  • cpe:2.3:a:tildearrow:furnace:dev10:*:*:*:*:*:*:* Versions dev10 Vulnerable ·tildearrow
  • cpe:2.3:a:tildearrow:furnace:dev62:*:*:*:*:*:*:* Versions dev62 Vulnerable ·tildearrow
  • cpe:2.3:a:tildearrow:furnace:dev63:*:*:*:*:*:*:* Versions dev63 Vulnerable ·tildearrow
  • cpe:2.3:a:tildearrow:furnace:dev64:*:*:*:*:*:*:* Versions dev64 Vulnerable ·tildearrow
  • cpe:2.3:a:tildearrow:furnace:dev65:*:*:*:*:*:*:* Versions dev65 Vulnerable ·tildearrow
  • cpe:2.3:a:tildearrow:furnace:dev66:*:*:*:*:*:*:* Versions dev66 Vulnerable ·tildearrow
  • cpe:2.3:a:tildearrow:furnace:dev67:*:*:*:*:*:*:* Versions dev67 Vulnerable ·tildearrow
  • cpe:2.3:a:tildearrow:furnace:dev68:*:*:*:*:*:*:* Versions dev68 Vulnerable ·tildearrow
  • cpe:2.3:a:tildearrow:furnace:dev69:*:*:*:*:*:*:* Versions dev69 Vulnerable ·tildearrow
  • cpe:2.3:a:tildearrow:furnace:dev70:*:*:*:*:*:*:* Versions dev70 Vulnerable ·tildearrow
  • cpe:2.3:a:tildearrow:furnace:dev71:*:*:*:*:*:*:* Versions dev71 Vulnerable ·tildearrow
  • cpe:2.3:a:tildearrow:furnace:dev72:*:*:*:*:*:*:* Versions dev72 Vulnerable ·tildearrow
  • cpe:2.3:a:tildearrow:furnace:dev73:*:*:*:*:*:*:* Versions dev73 Vulnerable ·tildearrow
  • cpe:2.3:a:tildearrow:furnace:dev75:*:*:*:*:*:*:* Versions dev75 Vulnerable ·tildearrow
  • cpe:2.3:a:tildearrow:furnace:dev76:*:*:*:*:*:*:* Versions dev76 Vulnerable ·tildearrow
  • cpe:2.3:a:tildearrow:furnace:dev77:*:*:*:*:*:*:* Versions dev77 Vulnerable ·tildearrow
  • cpe:2.3:a:tildearrow:furnace:dev78:*:*:*:*:*:*:* Versions dev78 Vulnerable ·tildearrow
  • cpe:2.3:a:tildearrow:furnace:dev79:*:*:*:*:*:*:* Versions dev79 Vulnerable ·tildearrow
  • cpe:2.3:a:tildearrow:furnace:dev80:*:*:*:*:*:*:* Versions dev80 Vulnerable ·tildearrow

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-1289
  2. 2026-10-03 Alias added: GHSA-j9m2-4gfx-jq57

References

Exploit 1

Patch 1

  • TI-2022-01099 tildearrow Furnace FUR to VGM Converter stack-based overflow CVSS 3.1MEDIUM 6.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences