Hi,

The following vulnerabilities were published for furnace.

CVE-2026-116730[0]:
| Furnace through 0.6.8.3 contains an out-of-bounds heap read
| vulnerability in DivEngine::loadFTM() in src/engine/fileOps/ftm.cpp,
| triggered by an unbounded DPCM note count during FamiTracker module
| import. Attackers can craft a .ftm, .dnm or 0CC/E-FamiTracker module
| with a 2A03 instrument note count above 120 to read past the noteMap
| array and crash Furnace when opened.

https://github.com/tildearrow/furnace/issues/2966
https://github.com/tildearrow/furnace/commit/c120c72391e3229fe258e5759f43427febcb8693


CVE-2026-116731[1]:
| Furnace through 0.6.8.3 contains an out-of-bounds write
| vulnerability in DivEngine::loadFTM() that allows attackers to
| corrupt heap memory via an unchecked subsong index in the GROOVES
| block. Attackers can craft a FamiTracker module with a subsong count
| of 2 or more to write a groove pattern past the subsong vector,
| crashing Furnace when opened.

https://github.com/tildearrow/furnace/issues/2966
https://github.com/tildearrow/furnace/commit/c120c72391e3229fe258e5759f43427febcb8693


If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-116730
https://www.cve.org/CVERecord?id=CVE-2026-116730
[1] https://security-tracker.debian.org/tracker/CVE-2026-116731
https://www.cve.org/CVERecord?id=CVE-2026-116731

Please adjust the affected versions in the BTS as needed.