furnace vulnerabilities
CVEs whose affected-version data names the furnace package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-116730Medium· 5.5Furnace through 0.6.8.3 Out-of-Bounds Read via FamiTracker Module Import
Furnace through 0.6.8.3 contains an out-of-bounds heap read vulnerability in DivEngine::loadFTM() in src/engine/fileOps/ftm.cpp, triggered by an unbounded DPCM note count during FamiTracker module import. Attackers can craft a .ftm, .dnm…
▾ Sunlittildearrow · furnaceEPSS 0.14%via CVEORG
CVE-2026-116731Medium· 6.1Furnace through 0.6.8.3 Out-of-Bounds Write via FamiTracker GROOVES Block Import
Furnace through 0.6.8.3 contains an out-of-bounds write vulnerability in DivEngine::loadFTM() that allows attackers to corrupt heap memory via an unchecked subsong index in the GROOVES block. Attackers can craft a FamiTracker module with…
▾ Sunlittildearrow · furnaceEPSS 0.14%via CVEORG