PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-116731 tildearrow CVE debrief

A vulnerability in Furnace through 0.6.8.3 allows for an out-of-bounds write via the FamiTracker GROOVES block import. This occurs in the DivEngine::loadFTM() function, where an unchecked subsong index can lead to heap memory corruption. An attacker can exploit this by crafting a FamiTracker module with a subsong count of 2 or more, causing Furnace to crash when the module is opened.

Vendor
tildearrow
Product
furnace
CVSS
MEDIUM 6.9
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-26
Original CVE updated
2026-11-05
Advisory published
2026-10-26
Advisory updated
2026-11-05

Who should care

Defenders responsible for systems or software that utilize Furnace, especially in environments where FamiTracker modules are imported from untrusted sources, should assess exposure and prioritize patching or mitigation.

Why it matters

CVE-2026-116731 is a medium-severity vulnerability in Furnace that allows for out-of-bounds writes via FamiTracker GROOVES block imports. Defenders should verify exposure, restrict imports of untrusted modules, and prioritize patching to prevent potential crashes and exploitation.

  • Potential for heap memory corruption leading to crashes
  • Possible exploitation via crafted FamiTracker modules
  • Verification of Furnace version and module import restrictions required
  • Patching or mitigation measures should be prioritized

Technical summary

The DivEngine::loadFTM() function in Furnace through 0.6.8.3 is vulnerable to an out-of-bounds write. This occurs when importing a FamiTracker module with a subsong count of 2 or more, allowing an attacker to write a groove pattern past the subsong vector. This results in heap memory corruption and can cause Furnace to crash. Affected product deployments should be verified, and patches applied if available. The vulnerability is confirmed in Furnace version 0.6.8.3 and earlier, and additional details are available from various supplemental sources, including GitHub issues and technical advisories.

Defensive priority

Medium priority should be given to verifying and patching Furnace installations, especially in environments where untrusted FamiTracker modules might be imported.

Recommended defensive actions

  • Verify Furnace version and apply patches if available
  • Restrict import of untrusted FamiTracker modules
  • Monitor for suspicious module imports and crashes
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is confirmed in Furnace version 0.6.8.3 and earlier. The CVE Program and NVD provide official records of this vulnerability. Additional details are available from various supplemental sources, including GitHub issues and technical advisories.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-116731 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-116731

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-116731 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-116731

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Furnace through 0.6.8.3 Out-of-Bounds Write via FamiTracker GROOVES Block Import

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/116xxx/CVE-2026-116731.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://github.com/tildearrow/furnace/issues/2966

    Supplemental source - issue-tracking

  • Source reference

    Unverified legacy reference

    URL: https://github.com/tildearrow/furnace

    Supplemental source - product

  • Source reference

    Unverified legacy reference

    URL: https://github.com/tildearrow/furnace/commit/c120c72391e3229fe258e5759f43427febcb8693

    Supplemental source - patch

  • Source reference

    Unverified legacy reference

    URL: https://github.com/tildearrow/furnace/blob/v0.6.8.3/src/engine/fileOps/ftm.cpp

    Supplemental source - technical-description

  • Source reference

    Unverified legacy reference

    URL: https://hackmd.io/@haindpwn/furnace-ftm-import-notemap-and-groove-subsong-oob

    Supplemental source - third-party-advisory

  • Source reference

    Unverified legacy reference

    URL: https://www.vulncheck.com/advisories/furnace-through-0.6.8.3-out-of-bounds-write-via-famitracker-grooves-block-import

    Supplemental source - third-party-advisory

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.