Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 6

Export CSV
CVE-2026-116731

Furnace through 0.6.8.3 Out-of-Bounds Write via FamiTracker GROOVES Block Import

Furnace through 0.6.8.3 contains an out-of-bounds write vulnerability in DivEngine::loadFTM() that allows attackers to corrupt heap memory via an unchecked subsong index in the GROOVES block. Attackers can craft a FamiTracker module with a subsong count of 2 or more to write a groove pattern past the subsong vector, crashing Furnace when opened.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Tildearrow
Products
Furnace
CVE-2026-116730

Furnace through 0.6.8.3 Out-of-Bounds Read via FamiTracker Module Import

Furnace through 0.6.8.3 contains an out-of-bounds heap read vulnerability in DivEngine::loadFTM() in src/engine/fileOps/ftm.cpp, triggered by an unbounded DPCM note count during FamiTracker module import. Attackers can craft a .ftm, .dnm or 0CC/E-FamiTracker module with a 2A03 instrument note count above 120 to read past the noteMap array and crash Furnace when opened.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Tildearrow
Products
Furnace
CVE-2026-24800

A heap-based buffer over-read or buffer overflow in tildearrow/furnace

Out-of-bounds Write, Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in tildearrow furnace (extern/zlib modules). This vulnerability is associated with program files inflate.C.

CVSS 4.0 · 10 Critical EPSS < 1% KEV · Not listed
Vendors
Tildearrow
Products
Furnace
CVE-2026-4732

Out-of-bounds Read Overflow in tildearrow/furnace

Out-of-bounds Read vulnerability in tildearrow furnace (‎extern/libsndfile-modified/src modules). This vulnerability is associated with program files flac.C‎. This issue affects furnace: before 0.7.

CVSS 4.0 · 8.4 High EPSS < 1% KEV · Not listed
Vendors
Tildearrow
Products
Furnace
CVE-2022-1211

tildearrow Furnace FUR to VGM Converter stack-based overflow

A vulnerability classified as critical has been found in tildearrow Furnace dev73. This affects the FUR to VGM converter in console mode which causes stack-based overflows and crashes. It is possible to initiate the attack remotely but it requires user-interaction. A POC has been disclosed to the public and may be used.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Tildearrow
Products
Furnace
CVE-2022-1289

tildearrow Furnace Incomplete Fix CVE-2022-1211 denial of service

A denial of service vulnerability was found in tildearrow Furnace. It has been classified as problematic. This is due to an incomplete fix of CVE-2022-1211. It is possible to initiate the attack remotely but it requires user interaction. The issue got fixed with the patch 0eb02422d5161767e9983bdaa5c429762d3477ce.

CVSS 3.1 · 4.3 Medium EPSS 1.2% KEV · Not listed
Vendors
Tildearrow
Products
Furnace