Furnace through 0.6.8.3 Out-of-Bounds Read via FamiTracker Module Import

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-116730 · Microsoft / collected KEV context

cve-program · CVE-2026-116730

• https://github.com/tildearrow/furnace/issues/2966
• https://github.com/tildearrow/furnace
• https://github.com/tildearrow/furnace/commit/c120c72391e3229fe258e5759f43427febcb8693
• https://github.com/tildearrow/furnace/blob/v0.6.8.3/src/engine/fileOps/ftm.cpp#L981-L1017
• https://hackmd.io/@haindpwn/furnace-ftm-import-notemap-and-groove-subsong-oob
• https://www.vulncheck.com/advisories/furnace-through-0.6.8.3-out-of-bounds-read-via-famitracker-module-import

• Furnace through 0.6.8.3 Out-of-Bounds Read via FamiTracker Module Import · Newly collected advisory · 26 Oct 2026