CVE-2026-110605

Deferred Deferred - Pending Action

Divide by Zero in libschrift Font Processing

Publication date: 2026-10-14

Last updated on: 2026-10-16

Assigner: VulnCheck

Description

libschrift through 0.10.2 contains a divide by zero vulnerability that allows attackers to crash applications by supplying a font with unitsPerEm of 0 in the head table. Attackers can provide a crafted TrueType font whose NaN glyph coordinates bypass clip_points(), causing an out-of-bounds raster read in draw_line() during sft_render() and crashing the process.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-110605

EUVD

EUVD-2026-101233

Affected Vendors & Products

Vendor	Product	Version / Range
tomolt	libschrift	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-369	The product divides a value by zero.

Attack-Flow Graph

Executive Summary

CVE-2026-110605 is a divide-by-zero vulnerability in libschrift v0.10.2, a TrueType font rasterizer. It occurs when a font with unitsPerEm set to zero is processed, causing infinite scale factors and NaN coordinates. These invalid coordinates bypass clipping checks, leading to out-of-bounds memory access during rendering and crashing the application.

Detection Guidance

To detect this vulnerability, inspect fonts for a unitsPerEm value of zero in the head table. Use tools like ttx (from fonttools) to extract font metadata: ttx -t head yourfont.ttf. Check for unitsPerEm=0. Monitor applications using libschrift for crashes when processing fonts.

Impact Analysis

This vulnerability allows attackers to crash applications by providing a specially crafted TrueType font. The crash occurs when the font is loaded and rendered, causing a denial of service due to a memory safety violation. No code execution or information leak has been demonstrated.

Compliance Impact

This vulnerability primarily causes application crashes due to a divide-by-zero error when processing fonts with unitsPerEm set to zero. It does not directly impact data confidentiality or integrity, which are key concerns for GDPR and HIPAA. However, repeated crashes could lead to denial-of-service conditions, potentially disrupting services handling sensitive data.

Mitigation Strategies

Immediately update libschrift to a patched version that validates unitsPerEm values. If updating is not possible, block untrusted fonts or implement input validation to reject fonts with unitsPerEm=0. Monitor applications for crashes and apply vendor patches as soon as available.

Hi! I’m here to help you understand CVE-2026-110605. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70