CVE-2026-116730

Name of the Vulnerable Software and Affected Versions Furnace versions prior to 0.6.8.4

Description An out-of-bounds heap read occurs during the import of FamiTracker modules (.ftm, .dnm, or 0CC/E-FamiTracker). The issue is triggered by an unbounded DPCM note count in the DivEngine::loadFTM() function within src/engine/fileOps/ftm.cpp. A specially crafted module with a 2A03 instrument note count exceeding 120 allows reading past the noteMap array, resulting in an application crash.

Recommendations Update Furnace to version 0.6.8.4 or later.