EUVD-2026-110479

Furnace through 0.6.8.3 contains an out-of-bounds write vulnerability in DivEngine::loadFTM that allows attackers to corrupt heap memory via an unchecked subsong index in the GROOVES block. Attackers can craft a FamiTracker module with a subsong count of 2 or more to write a groove pattern past t...

CVE-2026-116731 Furnace through 0.6.8.3 Out-of-Bounds Write via FamiTracker GROOVES Block Import

Furnace through 0.6.8.3 contains an out-of-bounds write vulnerability in DivEngine::loadFTM that allows attackers to corrupt heap memory via an unchecked subsong index in the GROOVES block. Attackers can craft a FamiTracker module with a subsong count of 2 or more to write a groove pattern past t...

CVE-2026-116731

The Furnace software (versions through 0.6.8.3 ) is vulnerable to an out-of-bounds write in the DivEngine::loadFTM() function. The root cause is an unchecked subsong index within the GROOVES block when importing a FamiTracker module. An attacker can craft a module with a subsong count of 2 or mor...