Source: furnace X-Debbugs-CC: [email protected] Severity: important Tags: security
Hi, The following vulnerabilities were published for furnace. CVE-2026-116730[0]: | Furnace through 0.6.8.3 contains an out-of-bounds heap read | vulnerability in DivEngine::loadFTM() in src/engine/fileOps/ftm.cpp, | triggered by an unbounded DPCM note count during FamiTracker module | import. Attackers can craft a .ftm, .dnm or 0CC/E-FamiTracker module | with a 2A03 instrument note count above 120 to read past the noteMap | array and crash Furnace when opened. https://github.com/tildearrow/furnace/issues/2966 https://github.com/tildearrow/furnace/commit/c120c72391e3229fe258e5759f43427febcb8693 CVE-2026-116731[1]: | Furnace through 0.6.8.3 contains an out-of-bounds write | vulnerability in DivEngine::loadFTM() that allows attackers to | corrupt heap memory via an unchecked subsong index in the GROOVES | block. Attackers can craft a FamiTracker module with a subsong count | of 2 or more to write a groove pattern past the subsong vector, | crashing Furnace when opened. https://github.com/tildearrow/furnace/issues/2966 https://github.com/tildearrow/furnace/commit/c120c72391e3229fe258e5759f43427febcb8693 If you fix the vulnerabilities please also make sure to include the CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-116730 https://www.cve.org/CVERecord?id=CVE-2026-116730 [1] https://security-tracker.debian.org/tracker/CVE-2026-116731 https://www.cve.org/CVERecord?id=CVE-2026-116731 Please adjust the affected versions in the BTS as needed.
