Is CVE-2026-116731 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-116731?

CVE-2026-116731 has a CVSS v3 severity of MEDIUM (6.1).

Back

CVE-2026-116731

Description

Furnace through 0.6.8.3 contains an out-of-bounds write vulnerability in DivEngine::loadFTM() that allows attackers to corrupt heap memory via an unchecked subsong index in the GROOVES block. Attackers can craft a FamiTracker module with a subsong count of 2 or more to write a groove pattern past the subsong vector, crashing Furnace when opened.