EUVD-2026-110478
GHSA-7fgc-rm9x-48wv
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious FamiTracker module
-
ExploitDeliver file to Furnace user
-
ExecutionDPCM note count >120 triggers OOB read in loadFTM()
-
ImpactApplication crashes (denial of service)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a victim to open an attacker-supplied FamiTracker-format module (.ftm, .dnm, or 0CC/E-FamiTracker) in Furnace; the file must contain a 2A03 instrument whose DPCM note count is set above 120, which is what drives the read past the noteMap array in DivEngine::loadFTM(). No authentication is required (PR:N), but the vector is local and file-based (AV:L) and depends on user interaction - the victim must actually open the crafted module (UI:P). Limiting factors: only the FamiTracker import code path is affected, delivery relies on social engineering to get the file opened, and the documented outcome is an application crash only (VA:H with VC:N/VI:N), not code execution or data disclosure. |
| Impact | Signals are consistent and point to a low-to-moderate, non-urgent issue. The input CVSS 4.0 base score is 6.8 (medium), driven entirely by availability impact (VA:H) with no confidentiality or integrity impact (VC:N/VI:N) and a local, user-interaction-dependent vector (AV:L/UI:P). EPSS is low at 0.14% (3rd percentile), the CVE is NOT in CISA KEV, and the SSVC framework records Exploitation: none, Automatable: no, Technical Impact: partial - all agreeing this is not under active or automatable exploitation. The vendor decision label is 'this_month' rather than act_now/emergency, consistent with the other signals. A public PoC reference exists (the hackmd writeup and GitHub issue #2966); it is not verified as working exploit code, so PoC availability must not be conflated with active exploitation. One conflict to note: the input Tags include 'Information Disclosure', but the CVSS vector sets VC:N - the documented effect is an out-of-bounds read that crashes Furnace, i.e. denial of service, not confirmed data disclosure. Net assessment: a genuine but limited-impact file-parsing DoS in niche software, appropriate to patch on a routine cycle rather than treat as an emergency. |
| Exploit ScenarioDerived | An attacker crafts a malicious FamiTracker-format module (.ftm, .dnm, or 0CC/E-FamiTracker) containing a 2A03 instrument whose DPCM note count exceeds 120, then distributes it through a chiptune community, forum, or file share. When a victim opens the module in Furnace (≤0.6.8.3), DivEngine::loadFTM() reads past the noteMap array and the application crashes. A public PoC reference exists but is not verified as working exploit code. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 28, 2026
An out-of-bounds heap read in Furnace's FamiTracker module importer (through 0.6.8.3) allows a crafted .ftm, .dnm or 0CC/E-FamiTracker file to drive DivEngine::loadFTM() past the noteMap array when a 2A03 instrument carries a DPCM note count above 120, crashing the tracker when the file is opened. The flaw is rated CVSS 6.8 (assessed as CVSS:3.1 AV:L/AC:L/PR:N/UI:R with C:N/I:N/A:H), reflecting that it is a local, file-based attack requiring the victim to open the malicious module; the documented outcome is a crash, not code execution or data disclosure. No confirmed active exploitation (not in CISA KEV, SSVC exploitation: none) and a low EPSS of 0.14% (3rd percentile) place it in the this_month remediation tier; a public technical writeup describing the import bug exists, but no verified working exploit code was identified at time of analysis.
RemediationAI
The vendor fix is upstream commit c120c72391e3229fe258e5759f43427febcb8693, which rejects DPCM note counts above 120 and adds a subsong index bounds check in DivEngine::loadFTM(); patch status is 'available from vendor' but no tagged release version containing the commit is confirmed in the available data, so treat this as an upstream fix (PR/commit) and upgrade to the first Furnace release that includes it rather than assuming a specific version number. Until such a build is deployed, the practical compensating control is to avoid opening untrusted .ftm, .dnm or 0CC/E-FamiTracker modules in Furnace - quarantine or inspect incoming module files before import, and restrict Furnace usage to files from trusted sources; the trade-off is reduced workflow for users who routinely load community modules, and there is no configuration switch documented that disables only the FamiTracker importer. Note that the impact is a crash on file open (availability only), so the main exposure is loss of unsaved work and denial of use rather than compromise; per the this_month decision tier, schedule the upgrade in the normal monthly patch cycle. Reference material: https://github.com/tildearrow/furnace/issues/2966, https://www.vulncheck.com/advisories/furnace-through-0.6.8.3-out-of-bounds-read-via-famitracker-module-import, and https://hackmd.io/@haindpwn/furnace-ftm-import-notemap-and-groove-subsong-oob.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Furnace is a multi-system chiptune tracker; its module import code in src/engine/fileOps/ftm.cpp parses FamiTracker-family formats (.ftm, .dnm, 0CC/E-FamiTracker) to reconstruct instruments and patterns. In the 2A03 (NES APU) instrument parser, the DPCM note count read from the file is used to index into a fixed noteMap array without validating it against the array bound, the classic CWE-125 out-of-bounds read: a count above 120 walks past the end of the heap-allocated map and reads adjacent memory, which terminates the process. The upstream fix commit c120c72391e3229fe258e5759f43427febcb8693 adds a hard check rejecting DPCM note counts above 120 (logging 'DPCM note count out of range!') and separately adds a subsong index bounds check (sub >= ds.subsong.size()) in the same file, indicating the importer also lacked validation on subsong counts referenced by the public writeup. CPE data attributes the affected codebase to tildearrow:furnace with a wildcard version range; EUVD lists affected versions as Furnace 0 through 0.6.8.3. The trigger is entirely in the import path, so only parsing of attacker-supplied module files is exposed - playback and other engine subsystems are not implicated by the available evidence.
Know when Furnace gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
File must be opened by the victim, so AV:L and UI:R with PR:N; the flaw only crashes the app, giving A:H with C:N/I:N.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
Furnace through 0.6.8.3 contains an out-of-bounds heap read vulnerability in DivEngine::loadFTM() in src/engine/fileOps/ftm.cpp, triggered by an unbounded DPCM note count during FamiTracker module import. Attackers can craft a .ftm, .dnm or 0CC/E-FamiTracker module with a 2A03 instrument note count above 120 to read past the noteMap array and crash Furnace when opened.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
A denial of service vulnerability was found in tildearrow Furnace. Rated medium severity (CVSS 6.5), this vulnerability
A vulnerability classified as critical has been found in tildearrow Furnace dev73. Rated medium severity (CVSS 6.5), thi
Out-of-bounds read in Furnace before version 0.7 allows local attackers to read sensitive memory contents through a craf
Out-of-bounds heap write in Furnace's FamiTracker FTM importer can crash the application and may allow limited memory co
Exploit-DB