CVE-2026-116730 in Furnace
Summary
by MITRE • 10/26/2026
Furnace through 0.6.8.3 contains an out-of-bounds heap read vulnerability in DivEngine::loadFTM() in src/engine/fileOps/ftm.cpp, triggered by an unbounded DPCM note count during FamiTracker module import. Attackers can craft a .ftm, .dnm or 0CC/E-FamiTracker module with a 2A03 instrument note count above 120 to read past the noteMap array and crash Furnace when opened.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/26/2026
The vulnerability identified in Furnace versions through 0.6.8.3 represents a critical memory safety flaw located within the DivEngine::loadFTM() function, specifically implemented in the source file src/engine/fileOps/ftm.cpp. This issue is classified as an out-of-bounds heap read, which falls under CWE-125: Out-of-bounds Read. The root cause of this vulnerability stems from insufficient validation of input data during the import process for FamiTracker modules. Specifically, the application fails to enforce upper bounds on the DPCM note count parameter when parsing instrument definitions within .ftm, .dnm, or 0CC/E-FamiTracker module files. In a properly secured implementation, any integer value representing resource allocation limits must be strictly validated against known maximum constraints before being used for memory operations or array indexing.
When an attacker crafts a malicious module file containing a 2A03 instrument note count exceeding the safe threshold of one hundred twenty, the application proceeds to access elements beyond the allocated boundaries of the internal noteMap array. Because this is a heap read vulnerability rather than a write operation, the immediate observable effect is typically a segmentation fault or an abrupt crash of the Furnace emulator when the file is opened and processed. While out-of-bounds reads are often less severe than writes because they do not directly allow for arbitrary code execution by overwriting control data, they can still lead to denial of service conditions that disrupt workflow and potentially leak sensitive memory contents if the read values are subsequently used in further logic without proper sanitization.
From an operational perspective, this vulnerability impacts users who import legacy tracker modules into Furnace for emulation or analysis purposes. An attacker could distribute a specially crafted module file through social engineering tactics, such as sharing it via forums, email, or peer-to-peer networks under the guise of legitimate content. Upon opening the malicious file within the vulnerable version of Furnace, the application will crash due to the illegal memory access. This constitutes a denial-of-service attack vector that targets the stability and availability of the software environment. Although the primary impact is currently limited to crashing the process, out-of-bounds reads can sometimes be leveraged in more complex exploitation chains if the read data influences subsequent control flow decisions or if side-channel attacks are feasible against the specific memory layout.
To mitigate this vulnerability, developers must implement strict input validation within the DivEngine::loadFTM() function before any array indexing occurs based on imported note counts. The code should explicitly check that the DPCM note count does not exceed one hundred twenty and reject or truncate inputs that violate this constraint. Additionally, employing static analysis tools and fuzzing techniques during the development lifecycle can help identify similar boundary checking errors across other file parsing functions in the engine. Users running affected versions are advised to upgrade to a patched version of Furnace as soon as it becomes available. Until then, caution should be exercised when opening module files from untrusted sources, and sandboxed environments or virtual machines may provide an additional layer of protection against potential crashes or further exploitation attempts. This incident highlights the importance of rigorous bounds checking in audio emulation software that handles complex legacy file formats with variable data structures.