CVE-2026-116731 in Furnace
Summary
by MITRE • 10/27/2026
Furnace through 0.6.8.3 contains an out-of-bounds write vulnerability in DivEngine::loadFTM() that allows attackers to corrupt heap memory via an unchecked subsong index in the GROOVES block. Attackers can craft a FamiTracker module with a subsong count of 2 or more to write a groove pattern past the subsong vector, crashing Furnace when opened.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/27/2026
The vulnerability identified within Furnace versions up to and including 0.6.8.3 represents a critical memory safety failure located in the DivEngine::loadFTM() function. This component is responsible for parsing FamiTracker module files, which are commonly used in chiptune music creation and emulation contexts. The specific flaw arises from an insufficient validation of input data during the loading process, specifically concerning the subsong index found within the GROOVES block of the file structure. When a crafted FamiTracker module is processed, the application fails to verify that the declared number of subsongs aligns with the available memory buffers or array bounds before attempting to access them. This lack of boundary checking allows an attacker who controls the input file to trigger an out-of-bounds write operation, leading directly to heap corruption.
From a technical perspective, this issue is classified as CWE-787: Out-of-Bounds Write. The vulnerability manifests when the subsong count in the GROOVES block is set to two or more, prompting the engine to allocate and access memory structures that exceed their intended limits. By writing data past the end of the allocated subsong vector, the attacker can overwrite adjacent heap metadata or other critical application state information. This corruption destabilizes the internal memory management system of Furnace, causing immediate instability during the file loading phase. The operational impact is primarily a denial of service, as the application will typically crash upon encountering this corrupted state when attempting to open the malicious module. While the primary observed effect is a crash, out-of-bounds writes in modern systems can sometimes be leveraged for more severe outcomes depending on heap layout and allocator behavior, potentially allowing for arbitrary code execution if an attacker can carefully control the overwritten data structures.
This vulnerability aligns with ATT&CK technique T1203: Exploitation for Defense Evasion or T1496: Resource Hijacking in contexts where resource exhaustion is the goal, though it most directly relates to initial exploitation vectors involving malformed inputs. The attack vector requires user interaction, as a victim must open a specially crafted FamiTracker module file within Furnace. This classifies the vulnerability under CWE-20: Improper Input Validation, highlighting the failure of the application to sanitize or validate external data before processing it. In environments where users frequently share chiptune files or engage with community-created content, this presents a significant risk if malicious actors distribute trojanized modules designed to exploit this specific parsing flaw.
Mitigation strategies should focus on immediate patching and defensive programming practices. The most effective remediation is for developers of Furnace to update the software to version 0.6.8.4 or later, where this boundary check has been implemented in DivEngine::loadFTM(). For organizations unable to immediately upgrade, implementing input validation at the point of file ingestion can provide a temporary buffer against exploitation. This involves strictly validating that subsong indices and counts fall within expected ranges before any memory allocation or access occurs. Additionally, enabling heap protection mechanisms such as Address Space Layout Randomization (ASLR) and Data Execution Prevention (DEP) on end-user systems can mitigate the potential for code execution resulting from the heap corruption, although these controls do not prevent the initial crash caused by the denial of service aspect of the vulnerability. Regular security audits of media parsing libraries are recommended to identify similar input validation gaps in other components handling complex file formats.