Live › vulnerability › CVE-2026-116730
Go to dashboardFurnace, a chiptune tracker, has an out-of-bounds heap read in its FamiTracker module loader when a 2A03 instrument declares more than 120 notes. An attacker who gets a user to open a crafted .ftm, .dnm or 0CC/E-FamiTracker file can crash Furnace.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 22:25 UTC. All times on this page are UTC.
Only people who open FamiTracker-format modules (.ftm, .dnm, 0CC/E-FamiTracker) in Furnace on a version through 0.6.8.3. Servers or pipelines that do not import these files are not exposed.
No product ranges from the sources yet.
furnace --version or check the installed Furnace version in the app's About dialog.0.6.8.3 or earlier.0.6.8.3 once the upstream fix is published (unknown from the sources).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Furnace through 0.6.8.3 contains an out-of-bounds heap read vulnerability in DivEngine::loadFTM() in src/engine/fileOps/ftm.cpp, triggered by an unbounded DPCM note count during FamiTracker module import. Attackers can craft a .ftm, .dnm or 0CC/E-FamiTracker module with a 2A03 instrument note count above 120 to read past the noteMap array and crash Furnace when opened.
This page as .md · .json · in your agent: get_signal("CVE-2026-116730")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.