CVE-2026-116731

Name of the Vulnerable Software and Affected Versions Furnace versions prior to 0.6.8.4

Description An out-of-bounds write exists in the DivEngine::loadFTM() function. This occurs when the software processes a FamiTracker module containing a GROOVES block with an unchecked subsong index. An attacker can craft a module with a subsong count of two or more to write a groove pattern beyond the subsong vector, leading to heap memory corruption and causing the application to crash upon opening the file.

Recommendations Update Furnace to version 0.6.8.4 or later.