CVE-2026-24800: 
CBL Mariner vulnerability analysis and mitigation

CVE-2026-24800 is a classic buffer overflow vulnerability (Out-of-bounds Write / Buffer Copy without Checking Size of Input) affecting the extern/zlib module of tildearrow Furnace, a chiptune tracker application. The flaw resides specifically in the inflate.C file and stems from a missing security patch for the upstream zlib vulnerability CVE-2022-37434. It affects Furnace versions prior to 0.6.8.3. The vulnerability was disclosed on January 27, 2026, and carries a CVSS v4.0 base score of 10.0 (Critical) (Red Hat Advisory, Red Hat Bugzilla, EUVD).

The root cause is that tildearrow Furnace cloned zlib's inflate() function into its extern/zlib module but did not apply the upstream security fix (madler/zlib commit eff308a) that addressed CVE-2022-37434. The vulnerability is classified as CWE-787 (Out-of-bounds Write) and CWE-120 (Buffer Copy without Checking Size of Input). Specifically, when processing a gzip header's extra field via inflate(), insufficient bounds checking allows a crafted input to overflow a heap buffer. A pull request (PR #2471) was submitted and merged on April 28, 2025, applying the same patch from the upstream zlib fix (GitHub PR, Red Hat Bugzilla).

Successful exploitation could result in complete compromise of confidentiality, integrity, and availability of the affected system, including potential remote code execution without authentication or user interaction. An attacker could leverage the heap buffer overflow to corrupt memory, execute arbitrary code in the context of the Furnace process, or cause a denial of service. Given the network-accessible attack vector and no privilege requirements, the blast radius extends to any system running a vulnerable version of Furnace that processes attacker-controlled compressed data (Red Hat Advisory, EUVD).

The fix was merged into the Furnace master branch on April 28, 2025 (PR #2471), applying the same patch as upstream zlib's eff308a commit. Users should upgrade to Furnace version 0.6.8.3 or later, which incorporates this fix (GitHub PR, EUVD). As interim mitigations, restrict network access to systems running Furnace, implement network segmentation to limit exposure, and avoid processing untrusted or externally sourced compressed files with vulnerable versions. Monitor for any exploitation attempts targeting the inflate.C module.

Red Hat tracked the vulnerability via its Bugzilla system with an "urgent" severity rating, and the EUVD (European Union Vulnerability Database) assigned it identifier EUVD-2026-4798 with a CVSS 4.0 score of 10.0 (Red Hat Bugzilla, EUVD). The contributing researcher (npt-1707) noted on GitHub that they planned to report the issue as a CVE after the fix was merged, reflecting a responsible disclosure approach (GitHub PR). No significant broader media coverage or notable researcher commentary beyond the patch discussion has been identified.