What is the CVSS score of CVE-2026-116731?

CVE-2026-116731 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N. EPSS exploitation probability: 0.1%.

Is there a patch available for CVE-2026-116731?

Yes, a patch is available for CVE-2026-116731. Update the affected software to the latest version immediately.

Furnace CVE-2026-116731

EUVD-2026-110479 MEDIUM

Improper Validation of Array Index (CWE-129)

2026-10-26 VulnCheck

GHSA-wgh7-jp98-6g9w

Buffer Overflow Furnace

6.9

CVSS 4.0 · Vendor: VulnCheck

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Craft FTM module with subsong count ≥2
Delivery

Deliver file to victim via share/download
Exploit

Victim opens module in Furnace
Execution

Unchecked subsong index writes past subsong vector
Impact

Heap corruption crashes application

Vulnerability Assessment

Weakness	CWE CWE-129 OWASP Top 10:2025 A05:2025 - Injection ASVS 5.0 V2 - Validation and Business Logic Array index validation
Exploitation Conditions	Exploitation requires a victim to open an attacker-supplied FamiTracker (.ftm) module in Furnace 0.6.8.3 or earlier; the module must specify a subsong count of 2 or more so that the GROOVES-block import path uses an unchecked subsong index. Limiting factors: the attack is local-file only (no network service is exposed), it requires user interaction to open the crafted file, and it is confined to the FamiTracker FTM import code path in DivEngine::loadFTM(). No authentication or special privileges are needed once the user opens the file.
Impact	This is a genuinely low-priority issue despite a mid-range CVSS 4.0 score of 6.9. The vector CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H describes a local attack requiring the victim to open a crafted file (UI:P), with impact limited to availability (VA:H) - i.e. a crash - plus minor integrity impact (VI:L) and no confidentiality impact (VC:N). The description itself states the result is that Furnace crashes when the file is opened, so this reads as a denial-of-service/heap-corruption crash, not demonstrated code execution. The decision signals are consistent and point to low urgency: EPSS is 0.14% (3rd percentile), there is NO CISA KEV listing, and the vuln.today Decision label is 'this_month' rather than act_now or emergency. The source diff confirms the mechanism - the fix adds a bounds check (`if (sub >= (int)ds.subsong.size()) break;`) against an unchecked subsong index. The one tension to flag: CWE-129 (improper array index validation) producing an out-of-bounds heap write theoretically carries code-execution potential, but the available evidence describes only a crash and does not establish controllable RCE - do not treat this as confirmed code execution. Overall: a real but low-severity, user-interaction-gated, local-file parsing bug in niche software; patch within normal cycles rather than emergency.
Exploit ScenarioDerived	An attacker crafts a malicious FamiTracker (.ftm) module with a subsong count of 2 or more and shares it through a chiptune/tracker community, forum, or download. When a victim opens it in Furnace 0.6.8.3 or earlier, the unchecked subsong index in the GROOVES block writes a groove pattern past the subsong vector, corrupting heap memory and crashing the application. A public technical write-up describing the flaw exists, but it is not verified as working weaponized exploit code.

This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).

Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Oct 28, 2026

Out-of-bounds heap write in Furnace's FamiTracker FTM importer can crash the application and may allow limited memory corruption when a user opens a crafted module with two or more subsongs. Furnace through 0.6.8.3 is affected; exploitation is local-file only and requires user interaction, with the trigger in the GROOVES-block handling in DivEngine::loadFTM(). This is a low-priority issue under the supplied decision signals, with EPSS 0.14%, no CISA KEV entry, and no public exploit identified at time of analysis.

RemediationAI

A vendor fix is available as upstream commit c120c72391e3229fe258e5759f43427febcb8693; apply that commit or update to a Furnace release that includes it, noting that the supplied data does not state an exact patched release number. Until upgraded, do not open untrusted .ftm modules in Furnace and run Furnace with minimal privileges or in a sandbox when handling third-party modules, accepting that this blocks the FTM import workflow for untrusted files. Relevant references are https://github.com/tildearrow/furnace/commit/c120c72391e3229fe258e5759f43427febcb8693 and https://github.com/tildearrow/furnace/issues/2966.

Affected VersionsENISA

Furnace 0 ≤0.6.8.3

Affected Packages

euvd furnace no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

Furnace is a chiptune tracker that imports FamiTracker .ftm modules. In the FTM format, the GROOVES block provides groove patterns tied to subsongs; in the affected code path, loadFTM() uses an unchecked subsong index without verifying it against the size of the ds.subsong vector. That is CWE-129, Improper Validation of Array Index, and a crafted module with a subsong count of 2 or more can drive a groove-pattern write past the subsong vector, corrupting heap memory. The upstream commit c120c72391e3229fe258e5759f43427febcb8693 adds a guard that breaks out when the subsong index exceeds ds.subsong.size(), along with a separate DPCM note-count check capped at 120.

Know when Furnace gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (VulnCheck) PRIMARY 6.9 MEDIUM

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N

vuln.today AI 6.1 MEDIUM

Opening a crafted local file needs user interaction (UI:R) but no privileges (PR:N); impact is heap corruption causing a crash, so A:H with only minor integrity (I:L) and no confidentiality.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Local

Attack Complexity

Low

Attack Requirements

None

Privileges Required

None

User Interaction

Passive

Vulnerable system: Confidentiality

None

Vulnerable system: Integrity

Low

Vulnerable system: Availability

High

Subsequent system: Confidentiality

None

Subsequent system: Integrity

None

Subsequent system: Availability

None

DescriptionCVE.org

Furnace through 0.6.8.3 contains an out-of-bounds write vulnerability in DivEngine::loadFTM() that allows attackers to corrupt heap memory via an unchecked subsong index in the GROOVES block. Attackers can craft a FamiTracker module with a subsong count of 2 or more to write a groove pattern past the subsong vector, crashing Furnace when opened.

Threat Intelligence Overview

EPSS Score

0.1%

Top 97% exploitable

Prevalence

Low

niche open-source chiptune tracker, no enterprise footprint

Data Quality

5 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS

GitHub

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity MEDIUM

CISA KEV No

Public POC No

EPSS 0.1%

Patch available Yes

Active threat No

Deciding rule

MEDIUM severity (CVSS 4.0-6.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Defer

Exploitation· derived

None

System Exposure· derived

Small

Automatable· derived

Human Impact· derived

Medium

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +34

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.