CVE-2026-116730 Furnace through 0.6.8.3 Out-of-Bounds Read via FamiTracker Module Import

Medium 6.8 Published 26 Oct 2026 Updated 27 Oct 2026

Exploited in the wild: Not known
Fix: None listed

What is CVE-2026-116730?

CVE-2026-116730 is a medium-severity vulnerability in tildearrow furnace, published on 26 Oct 2026.

Official description

Furnace through 0.6.8.3 contains an out-of-bounds heap read vulnerability in DivEngine::loadFTM() in src/engine/fileOps/ftm.cpp, triggered by an unbounded DPCM note count during FamiTracker module import. Attackers can craft a .ftm, .dnm or 0CC/E-FamiTracker module with a 2A03 instrument note count above 120 to read past the noteMap array and crash Furnace when opened.

Weakness: CWE-125

Which versions are affected by CVE-2026-116730?

How do I fix CVE-2026-116730?

No fix has been published for CVE-2026-116730 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-116730 being exploited?

There is no known exploitation of CVE-2026-116730 in the wild and no public exploit code.

Sources

Also known as GHSA-7fgc-rm9x-48wv, UBUNTU-CVE-2026-116730.