EUVD-2026-110478

Furnace through 0.6.8.3 contains an out-of-bounds heap read vulnerability in DivEngine::loadFTM in src/engine/fileOps/ftm.cpp, triggered by an unbounded DPCM note count during FamiTracker module import. Attackers can craft a .ftm, .dnm or 0CC/E-FamiTracker module with a 2A03 instrument note count...

CVE-2026-116730

The software Furnace versions through 0.6.8.3 is vulnerable to an out-of-bounds heap read within the DivEngine::loadFTM() function located in src/engine/fileOps/ftm.cpp. The flaw is triggered during the import of FamiTracker modules due to an unbounded DPCM note count . Specifically, an attacker ...

CVE-2026-116730 Furnace through 0.6.8.3 Out-of-Bounds Read via FamiTracker Module Import

Furnace through 0.6.8.3 contains an out-of-bounds heap read vulnerability in DivEngine::loadFTM in src/engine/fileOps/ftm.cpp, triggered by an unbounded DPCM note count during FamiTracker module import. Attackers can craft a .ftm, .dnm or 0CC/E-FamiTracker module with a 2A03 instrument note count...