CVE-2026-24800

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-24800", "assignerOrgId": "1a37b84a-8e51-4525-b3d6-87e2fae01dbd", "state": "PUBLISHED", "assignerShortName": "GovTech CSG", "dateReserved": "2026-01-27T08:18:43.268Z", "datePublished": "2026-01-27T08:33:16.882Z", "dateUpdated": "2026-01-27T17:02:21.459Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://github.com/tildearrow/furnace", "defaultStatus": "unaffected", "modules": ["extern/zlib"], "product": "furnace", "programFiles": ["inflate.c"], "vendor": "tildearrow", "versions": [{"lessThan": "0.6.8.3", "status": "affected", "version": "0", "versionType": "git"}]}], "credits": [{"lang": "en", "type": "reporter", "value": "TITAN Team (titancaproject@gmail.com)"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Out-of-bounds Write, Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in tildearrow furnace (extern/zlib modules).<p> This vulnerability is associated with program files <tt>inflate.C</tt>.<br></p>"}], "value": "Out-of-bounds Write, Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in tildearrow furnace (extern/zlib modules). This vulnerability is associated with program files inflate.C."}], "metrics": [{"cvssV4_0": {"Automatable": "YES", "Recovery": "USER", "Safety": "NEGLIGIBLE", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 10, "baseSeverity": "CRITICAL", "exploitMaturity": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "RED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "DIFFUSE", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/S:N/AU:Y/R:U/V:D/RE:L/U:Red", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "LOW"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-787", "description": "CWE-787 Out-of-bounds Write", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-120", "description": "CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "1a37b84a-8e51-4525-b3d6-87e2fae01dbd", "shortName": "GovTech CSG", "dateUpdated": "2026-01-27T08:33:16.882Z"}, "references": [{"tags": ["patch"], "url": "https://github.com/tildearrow/furnace/pull/2471"}], "source": {"discovery": "UNKNOWN"}, "title": "A heap-based buffer over-read or buffer overflow in tildearrow/furnace", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-27T17:02:10.616812Z", "id": "CVE-2026-24800", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-27T17:02:21.459Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-24800", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-01-27T17:02:10.616812Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-27T17:02:17.596Z"}}], "cna": {"title": "A heap-based buffer over-read or buffer overflow in tildearrow/furnace", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "reporter", "value": "TITAN Team (titancaproject@gmail.com)"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NEGLIGIBLE", "version": "4.0", "Recovery": "USER", "baseScore": 10, "Automatable": "YES", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "DIFFUSE", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/S:N/AU:Y/R:U/V:D/RE:L/U:Red", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "RED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "tildearrow", "modules": ["extern/zlib"], "product": "furnace", "versions": [{"status": "affected", "version": "0", "lessThan": "0.6.8.3", "versionType": "git"}], "programFiles": ["inflate.c"], "collectionURL": "https://github.com/tildearrow/furnace", "defaultStatus": "unaffected"}], "references": [{"url": "https://github.com/tildearrow/furnace/pull/2471", "tags": ["patch"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Out-of-bounds Write, Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in tildearrow furnace (extern/zlib modules). This vulnerability is associated with program files inflate.C.", "supportingMedia": [{"type": "text/html", "value": "Out-of-bounds Write, Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in tildearrow furnace (extern/zlib modules).<p> This vulnerability is associated with program files <tt>inflate.C</tt>.<br></p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-787", "description": "CWE-787 Out-of-bounds Write"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-120", "description": "CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')"}]}], "providerMetadata": {"orgId": "1a37b84a-8e51-4525-b3d6-87e2fae01dbd", "shortName": "GovTech CSG", "dateUpdated": "2026-01-27T08:33:16.882Z"}}}, "cveMetadata": {"cveId": "CVE-2026-24800", "state": "PUBLISHED", "dateUpdated": "2026-01-27T17:02:21.459Z", "dateReserved": "2026-01-27T08:18:43.268Z", "assignerOrgId": "1a37b84a-8e51-4525-b3d6-87e2fae01dbd", "datePublished": "2026-01-27T08:33:16.882Z", "assignerShortName": "GovTech CSG"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://github.com/tildearrow/furnace", "defaultStatus": "unaffected", "modules": ["extern/zlib"], "product": "furnace", "programFiles": ["inflate.c"], "vendor": "tildearrow", "versions": [{"lessThan": "0.6.8.3", "status": "affected", "version": "0", "versionType": "git"}]}], "source": "cve_disclosure@tech.gov.sg"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Out-of-bounds Write, Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in tildearrow furnace (extern/zlib modules). This vulnerability is associated with program files inflate.C."}, {"lang": "es", "value": "Escritura fuera de l\u00edmites, Copia de b\u00fafer sin verificar el tama\u00f1o de la entrada ('Desbordamiento de b\u00fafer cl\u00e1sico') vulnerabilidad en tildearrow furnace (m\u00f3dulos extern/zlib). Esta vulnerabilidad est\u00e1 asociada con los archivos de programa inflate.C."}], "id": "CVE-2026-24800", "lastModified": "2026-06-17T10:23:36.730", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "YES", "Recovery": "USER", "Safety": "NEGLIGIBLE", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 10.0, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "RED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "DIFFUSE", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:D/RE:L/U:Red", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "LOW"}, "source": "cve_disclosure@tech.gov.sg", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-24800", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-01-27T17:02:10.616812Z", "version": "2.0.3"}}]}, "published": "2026-01-27T09:15:49.920", "references": [{"source": "cve_disclosure@tech.gov.sg", "url": "https://github.com/tildearrow/furnace/pull/2471"}], "sourceIdentifier": "cve_disclosure@tech.gov.sg", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-120"}, {"lang": "en", "value": "CWE-787"}], "source": "cve_disclosure@tech.gov.sg", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T02:26:43.682862+00:00", "value": {"mitigation_remediation": ["Apply the patch introduced by pull request 2471 or upgrade Furnace to a version that includes the fix.", "Validate the size of compressed data before processing or enforce strict input sanitation in the inflate function to prevent buffer overflow.", "If upgrading is not possible, consider disabling or removing the zlib inflate functionality or isolating Furnace processes in a restricted network segment to limit exposure."], "summary": {"action": "Apply Patch", "impact": "Remote Code Execution"}, "threat_synthesis": {"affected_systems": "The affected product is Furnace by tildearrow. All deployments of Furnace that include the zlib inflate.C implementation prior to the fix introduced in pull request 2471 are vulnerable. No specific version range is listed; the issue is tied to the code present before that PR.", "description_and_impact": "The vulnerability is a classic buffer overflow caused by an out\u2011of\u2011bounds write in the inflate.C module of the Furnace project, which uses external zlib. The overflow happens during a buffer copy that does not verify the size of the input, allowing an attacker to overwrite adjacent heap memory. This can corrupt program state and, if successfully abused, lead to arbitrary code execution or denial of service. The weakness aligns with CWE-120 and CWE-787.", "risk_and_exploitability": "The CVSS score is 10, indicating maximum severity. The EPSS is less than 1%, suggesting very low exploitation probability currently, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be remote, as an adversary can craft a malicious compressed stream sent to a process that will parse it. Successful exploitation would require the target running the vulnerable version of Furnace and the ability to supply the crafted input, making the condition a simple remote injection. Given the high score but low EPSS, the risk remains high for targeted or pre\u2011planned attacks, and it is prudent to remediate promptly."}}}}, "created": "2026-01-27T20:16:51.543146+00:00", "updated": "2026-04-18T02:30:15.870403+00:00", "vendors": ["tildearrow", "tildearrow$PRODUCT$furnace"]}