CVE-2026-116731

A flaw was found in Furnace. The application does not properly validate subsong indices when parsing FamiTracker module files, leading to an out-of-bounds write. By convincing a user to open a specially crafted file, an attacker can corrupt memory and cause the application to crash, resulting in ...

CVE-2026-116730

A flaw was found in Furnace. This vulnerability allows an attacker to cause a Denial of Service DoS by convincing a user to open a specially crafted FamiTracker module file. The application fails to properly validate instrument note counts during file import, resulting in an out-of-bounds read th...

EUVD-2026-110479

Furnace through 0.6.8.3 contains an out-of-bounds write vulnerability in DivEngine::loadFTM that allows attackers to corrupt heap memory via an unchecked subsong index in the GROOVES block. Attackers can craft a FamiTracker module with a subsong count of 2 or more to write a groove pattern past t...

EUVD-2026-110478

Furnace through 0.6.8.3 contains an out-of-bounds heap read vulnerability in DivEngine::loadFTM in src/engine/fileOps/ftm.cpp, triggered by an unbounded DPCM note count during FamiTracker module import. Attackers can craft a .ftm, .dnm or 0CC/E-FamiTracker module with a 2A03 instrument note count...

CVE-2026-116731

Furnace through 0.6.8.3 contains an out-of-bounds write vulnerability in DivEngine::loadFTM that allows attackers to corrupt heap memory via an unchecked subsong index in the GROOVES block. Attackers can craft a FamiTracker module with a subsong count of 2 or more to write a groove pattern past t...

CVE-2026-116730

Furnace through 0.6.8.3 contains an out-of-bounds heap read vulnerability in DivEngine::loadFTM in src/engine/fileOps/ftm.cpp, triggered by an unbounded DPCM note count during FamiTracker module import. Attackers can craft a .ftm, .dnm or 0CC/E-FamiTracker module with a 2A03 instrument note count...

CVE-2026-116730

The software Furnace versions through 0.6.8.3 is vulnerable to an out-of-bounds heap read within the DivEngine::loadFTM() function located in src/engine/fileOps/ftm.cpp. The flaw is triggered during the import of FamiTracker modules due to an unbounded DPCM note count . Specifically, an attacker ...

CVE-2026-116730 Furnace through 0.6.8.3 Out-of-Bounds Read via FamiTracker Module Import

Furnace through 0.6.8.3 contains an out-of-bounds heap read vulnerability in DivEngine::loadFTM in src/engine/fileOps/ftm.cpp, triggered by an unbounded DPCM note count during FamiTracker module import. Attackers can craft a .ftm, .dnm or 0CC/E-FamiTracker module with a 2A03 instrument note count...

CVE-2026-116731 Furnace through 0.6.8.3 Out-of-Bounds Write via FamiTracker GROOVES Block Import

Furnace through 0.6.8.3 contains an out-of-bounds write vulnerability in DivEngine::loadFTM that allows attackers to corrupt heap memory via an unchecked subsong index in the GROOVES block. Attackers can craft a FamiTracker module with a subsong count of 2 or more to write a groove pattern past t...

CVE-2026-116730 Furnace through 0.6.8.3 Out-of-Bounds Read via FamiTracker Module Import

Furnace through 0.6.8.3 contains an out-of-bounds heap read vulnerability in DivEngine::loadFTM in src/engine/fileOps/ftm.cpp, triggered by an unbounded DPCM note count during FamiTracker module import. Attackers can craft a .ftm, .dnm or 0CC/E-FamiTracker module with a 2A03 instrument note count...

PT-2026-125480

Name of the Vulnerable Software and Affected Versions Furnace versions prior to 0.6.8.4 Description An out-of-bounds write exists in the DivEngine::loadFTM function. This occurs when the software processes a FamiTracker module containing a GROOVES block with an unchecked subsong index. An attacke...

famitracker.com XSS vulnerability

Vulnerable URL: http://famitracker.com/forum/posts.php?id=5819"'--! Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 282114 VIP website status:| No Check famitracker.com SSL connection:| Grade: F Coordinated...