CVE-2026-116731

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-116731", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-10-26T20:23:35.128Z", "datePublished": "2026-10-26T21:52:32.953Z", "dateUpdated": "2026-11-05T16:48:53.686Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-26T21:52:32.953Z"}, "datePublic": "2026-10-22T00:00:00.000Z", "title": "Furnace through 0.6.8.3 Out-of-Bounds Write via FamiTracker GROOVES Block Import", "descriptions": [{"lang": "en", "value": "Furnace through 0.6.8.3 contains an out-of-bounds write vulnerability in DivEngine::loadFTM() that allows attackers to corrupt heap memory via an unchecked subsong index in the GROOVES block. Attackers can craft a FamiTracker module with a subsong count of 2 or more to write a groove pattern past the subsong vector, crashing Furnace when opened."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Improper Validation of Array Index", "cweId": "CWE-129", "type": "CWE"}]}], "affected": [{"vendor": "tildearrow", "product": "furnace", "defaultStatus": "unaffected", "versions": [{"version": "0", "status": "affected", "versionType": "custom", "lessThanOrEqual": "0.6.8.3"}], "packageURL": "pkg:github/tildearrow/furnace", "repo": "https://github.com/tildearrow/furnace"}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:tildearrow:furnace:*:*:*:*:*:*:*:*", "versionEndIncluding": "0.6.8.3"}]}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N", "attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 6.9, "baseSeverity": "MEDIUM"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "availabilityImpact": "HIGH", "baseScore": 6.1, "baseSeverity": "MEDIUM"}}], "references": [{"url": "https://github.com/tildearrow/furnace/issues/2966", "tags": ["issue-tracking"], "name": "GitHub Issue #2966"}, {"url": "https://github.com/tildearrow/furnace", "tags": ["product"]}, {"url": "https://github.com/tildearrow/furnace/commit/c120c72391e3229fe258e5759f43427febcb8693", "tags": ["patch"]}, {"url": "https://github.com/tildearrow/furnace/blob/v0.6.8.3/src/engine/fileOps/ftm.cpp#L1597-L1605", "tags": ["technical-description"]}, {"url": "https://hackmd.io/@haindpwn/furnace-ftm-import-notemap-and-groove-subsong-oob", "tags": ["third-party-advisory"]}, {"name": "VulnCheck Advisory: Furnace through 0.6.8.3 Out-of-Bounds Write via FamiTracker GROOVES Block Import", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/furnace-through-0.6.8.3-out-of-bounds-write-via-famitracker-grooves-block-import"}], "credits": [{"lang": "en", "value": "HaiND from the Post and Telecommunication Institute of Technology", "type": "finder"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"references": [{"url": "https://hackmd.io/@haindpwn/furnace-ftm-import-notemap-and-groove-subsong-oob", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-05T16:48:41.014412Z", "id": "CVE-2026-116731", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T16:48:53.686Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-116731", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-05T16:48:41.014412Z"}}}], "references": [{"url": "https://hackmd.io/@haindpwn/furnace-ftm-import-notemap-and-groove-subsong-oob", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T16:48:25.491Z"}}], "cna": {"title": "Furnace through 0.6.8.3 Out-of-Bounds Write via FamiTracker GROOVES Block Import", "credits": [{"lang": "en", "type": "finder", "value": "HaiND from the Post and Telecommunication Institute of Technology"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 6.9, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"repo": "https://github.com/tildearrow/furnace", "vendor": "tildearrow", "product": "furnace", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "0.6.8.3"}], "packageURL": "pkg:github/tildearrow/furnace", "defaultStatus": "unaffected"}], "datePublic": "2026-10-22T00:00:00.000Z", "references": [{"url": "https://github.com/tildearrow/furnace/issues/2966", "name": "GitHub Issue #2966", "tags": ["issue-tracking"]}, {"url": "https://github.com/tildearrow/furnace", "tags": ["product"]}, {"url": "https://github.com/tildearrow/furnace/commit/c120c72391e3229fe258e5759f43427febcb8693", "tags": ["patch"]}, {"url": "https://github.com/tildearrow/furnace/blob/v0.6.8.3/src/engine/fileOps/ftm.cpp#L1597-L1605", "tags": ["technical-description"]}, {"url": "https://hackmd.io/@haindpwn/furnace-ftm-import-notemap-and-groove-subsong-oob", "tags": ["third-party-advisory"]}, {"url": "https://www.vulncheck.com/advisories/furnace-through-0.6.8.3-out-of-bounds-write-via-famitracker-grooves-block-import", "name": "VulnCheck Advisory: Furnace through 0.6.8.3 Out-of-Bounds Write via FamiTracker GROOVES Block Import", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck-endgame"}, "descriptions": [{"lang": "en", "value": "Furnace through 0.6.8.3 contains an out-of-bounds write vulnerability in DivEngine::loadFTM() that allows attackers to corrupt heap memory via an unchecked subsong index in the GROOVES block. Attackers can craft a FamiTracker module with a subsong count of 2 or more to write a groove pattern past the subsong vector, crashing Furnace when opened."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-129", "description": "Improper Validation of Array Index"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:tildearrow:furnace:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndIncluding": "0.6.8.3"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-26T21:52:32.953Z"}}}, "cveMetadata": {"cveId": "CVE-2026-116731", "state": "PUBLISHED", "dateUpdated": "2026-11-05T16:48:53.686Z", "dateReserved": "2026-10-26T20:23:35.128Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-10-26T21:52:32.953Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageURL": "pkg:github/tildearrow/furnace", "product": "furnace", "repo": "https://github.com/tildearrow/furnace", "vendor": "tildearrow", "versions": [{"lessThanOrEqual": "0.6.8.3", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Furnace through 0.6.8.3 contains an out-of-bounds write vulnerability in DivEngine::loadFTM() that allows attackers to corrupt heap memory via an unchecked subsong index in the GROOVES block. Attackers can craft a FamiTracker module with a subsong count of 2 or more to write a groove pattern past the subsong vector, crashing Furnace when opened."}], "id": "CVE-2026-116731", "lastModified": "2026-11-05T17:17:44.107", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 4.2, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.9, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-116731", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-05T16:48:41.014412Z", "version": "2.0.3"}}]}, "published": "2026-10-26T22:16:57.073", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/tildearrow/furnace"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/tildearrow/furnace/blob/v0.6.8.3/src/engine/fileOps/ftm.cpp#L1597-L1605"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/tildearrow/furnace/commit/c120c72391e3229fe258e5759f43427febcb8693"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/tildearrow/furnace/issues/2966"}, {"source": "disclosure@vulncheck.com", "url": "https://hackmd.io/@haindpwn/furnace-ftm-import-notemap-and-groove-subsong-oob"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/furnace-through-0.6.8.3-out-of-bounds-write-via-famitracker-grooves-block-import"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://hackmd.io/@haindpwn/furnace-ftm-import-notemap-and-groove-subsong-oob"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-129"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{"bugzilla": {"description": "furnace: Furnace: Denial of Service via out-of-bounds write during FamiTracker module parsing", "id": "2561450", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2561450"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.1", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H", "status": "draft"}, "cwe": "CWE-787", "details": ["Furnace through 0.6.8.3 contains an out-of-bounds write vulnerability in DivEngine::loadFTM() that allows attackers to corrupt heap memory via an unchecked subsong index in the GROOVES block. Attackers can craft a FamiTracker module with a subsong count of 2 or more to write a groove pattern past the subsong vector, crashing Furnace when opened.", "A flaw was found in Furnace. The application does not properly validate subsong indices when parsing FamiTracker module files, leading to an out-of-bounds write. By convincing a user to open a specially crafted file, an attacker can corrupt memory and cause the application to crash, resulting in a Denial of Service (DoS)."], "name": "CVE-2026-116731", "public_date": "2026-10-26T21:52:32Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-116731\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-116731\nhttps://github.com/tildearrow/furnace\nhttps://github.com/tildearrow/furnace/blob/v0.6.8.3/src/engine/fileOps/ftm.cpp#L1597-L1605\nhttps://github.com/tildearrow/furnace/commit/c120c72391e3229fe258e5759f43427febcb8693\nhttps://github.com/tildearrow/furnace/issues/2966\nhttps://hackmd.io/@haindpwn/furnace-ftm-import-notemap-and-groove-subsong-oob\nhttps://www.vulncheck.com/advisories/furnace-through-0.6.8.3-out-of-bounds-write-via-famitracker-grooves-block-import"], "statement": "This vulnerability is rated as Moderate severity because exploitation requires local user interaction to process a maliciously crafted audio file, limiting the primary impact to application denial of service. Furthermore, the affected software is not distributed or supported within Red Hat Enterprise Linux, restricting any potential risk to community environments.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,0.6.8.3]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "inferred", "scores": [{"score": 100.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "furnace", "source": "cna", "vendor": "tildearrow"}, "product": "furnace", "vendor": "tildearrow"}], "created": "2026-10-27T06:45:06.703267+00:00", "updated": "2026-10-30T15:15:07.718352+00:00", "vendors": ["tildearrow", "tildearrow$PRODUCT$furnace"]}