EUVD-2026-110479

Furnace through 0.6.8.3 contains an out-of-bounds write vulnerability in DivEngine::loadFTM that allows attackers to corrupt heap memory via an unchecked subsong index in the GROOVES block. Attackers can craft a FamiTracker module with a subsong count of 2 or more to write a groove pattern past t...