Furnace through 0.6.8.3 Out-of-Bounds Write via FamiTracker GROOVES Block Import

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-116731 · Microsoft / collected KEV context

cve-program · CVE-2026-116731

• https://github.com/tildearrow/furnace/issues/2966
• https://github.com/tildearrow/furnace
• https://github.com/tildearrow/furnace/commit/c120c72391e3229fe258e5759f43427febcb8693
• https://github.com/tildearrow/furnace/blob/v0.6.8.3/src/engine/fileOps/ftm.cpp#L1597-L1605
• https://hackmd.io/@haindpwn/furnace-ftm-import-notemap-and-groove-subsong-oob
• https://www.vulncheck.com/advisories/furnace-through-0.6.8.3-out-of-bounds-write-via-famitracker-grooves-block-import

• Furnace through 0.6.8.3 Out-of-Bounds Write via FamiTracker GROOVES Block Import · Newly collected advisory · 26 Oct 2026