PT-2026-4869 · Unknown+1 · Tildearrow Furnace+1

Titan Team · Published 2026-01-27 · Updated 2026-01-27 · CVE-2026-24800

Positive Technologies (AI Summary)

CVSS v4.0

10

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:D/RE:L/U:Red

Name of the Vulnerable Software and Affected Versions tildearrow furnace (affected versions not specified)

Description An out-of-bounds write issue, specifically a buffer copy without checking the size of the input ('Classic Buffer Overflow'), exists in the furnace software within the extern/zlib modules, specifically in the inflate.C file. This condition can lead to remote code execution without requiring user interaction.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Memory Corruption

Buffer Overflow

Weakness Enumeration

CWE-787

CWE-120

Related Identifiers

AZL-77997

AZL-78003

AZL-78006

AZL-78047

CVE-2026-24800

Affected Products

Tildearrow Furnace

Zlib

References · 9

• https://github.com/tildearrow/furnace/pull/2471 · Patch
• https://osv.dev/vulnerability/AZL-78006 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-78047 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-24800 · Security Note
• https://osv.dev/vulnerability/AZL-78003 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-24800 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-77997 · Vendor Advisory
• https://twitter.com/0dayPublishing/status/2016072803405938690 · Twitter Post
• https://twitter.com/CVEnew/status/2016073215018201470 · Twitter Post