Threats tagged 'ghsa-wgh7-jp98-6g9w'

Furnace versions up to 0.6.8.3 have an out-of-bounds write vulnerability in the DivEngine::loadFTM() function. This flaw allows attackers to corrupt heap memory by using an unchecked subsong index in the GROOVES block of a crafted FamiTracker module. Specifically, a subsong count of 2 or more can cause a groove pattern to be written past the subsong vector, leading to a crash when Furnace opens the module.