Read the docs
TI-2026-80939 Aliases CVE-2026-116730GHSA-7fgc-rm9x-48wv

Out-of-bounds read in Furnace FamiTracker module import

Priority LOW 29CWE-125Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-125 and the CVSS impact.

Summary

Furnace through 0.6.8.3 contains an out-of-bounds heap read in its FamiTracker module import code, caused by an unbounded DPCM note count (CWE-125). If a user opens a crafted .ftm, .dnm or 0CC/E-FamiTracker module with a 2A03 instrument note count above 120, Furnace reads past the noteMap array and crashes.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

Furnace through 0.6.8.3 contains an out-of-bounds heap read vulnerability in DivEngine::loadFTM() in src/engine/fileOps/ftm.cpp, triggered by an unbounded DPCM note count during FamiTracker module import. Attackers can craft a .ftm, .dnm or 0CC/E-FamiTracker module with a 2A03 instrument note count above 120 to read past the noteMap array and crash Furnace when opened.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00136 3rd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
tildearrowfurnaceup to 0.6.8.3—No fix listedCNA
  • furnace Vendortildearrow Affected up to 0.6.8.3 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for Furnace.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-26 Threatist record created from CVE-2026-116730
  2. 2026-10-27 Affected versions changed · Red Hat
  3. 2026-10-27 CVSS score added · Red Hat
  4. 2026-10-27 CISA SSVC decision points changed
  5. 2026-10-27 Priority changed: MEDIUM → LOW
  6. 2026-10-27 Alias added: GHSA-7fgc-rm9x-48wv

References

Patch 1

Advisory 1

Other 3

  • TI-2026-80940 Out-of-bounds write in Furnace when importing FamiTracker modules CVSS 4.0MEDIUM 6.9
  • TI-2022-01173 tildearrow Furnace Incomplete Fix CVE-2022-1211 denial of service CVSS 3.1MEDIUM 6.5
  • TI-2022-01099 tildearrow Furnace FUR to VGM Converter stack-based overflow CVSS 3.1MEDIUM 6.5
  • TI-2026-19999 A heap-based buffer over-read or buffer overflow in tildearrow/furnace CVSS 4.0CRITICAL 10.0
  • TI-2026-04127 Out-of-bounds Read Overflow in tildearrow/furnace CVSS 4.0HIGH 8.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences