CVE-2026-113679
Received Received - Intake

Out-of-Bounds Write in HarfBuzz Font Processing

Publication date: 2026-10-20

Last updated on: 2026-10-20

Assigner: VulnCheck

Description
HarfBuzz 8.0.0 through 14.6.0 contains an out-of-bounds write vulnerability in the experimental WebAssembly shaper because the font_glyph_to_string import has a wrong WAMR signature. Attackers can supply a crafted font whose wasm module places the output buffer near linear memory's end, writing glyph-name bytes into host memory to crash or corrupt applications.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-20
Last Modified
2026-10-20
Generated
2026-10-20
AI Q&A
2026-10-20
EPSS Evaluated
N/A
NVD
CVE-2026-113679
EUVD
EUVD-2026-105095

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
harfbuzz harfbuzz 8.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-787 The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an out-of-bounds write flaw in HarfBuzz versions 8.0.0 through 14.6.0. It occurs in the experimental WebAssembly shaper due to an incorrect function signature for font_glyph_to_string. Attackers can exploit this by crafting a font with a WASM module that places the output buffer near linear memory's end, allowing writes beyond allocated memory. This can crash applications or corrupt memory.

Detection Guidance

To detect this vulnerability, check if your system uses HarfBuzz versions 8.0.0 through 14.6.0. Run: harfbuzz-info --version or check package managers like apt list --installed | grep harfbuzz. Inspect WASM-enabled builds for the experimental shaper.

Impact Analysis

If you use applications relying on HarfBuzz (e.g., text rendering libraries), this flaw could allow attackers to crash your software or corrupt memory by providing malicious fonts. This may lead to denial-of-service or potential code execution if combined with other vulnerabilities.

Mitigation Strategies

Upgrade HarfBuzz to a patched version beyond 14.6.0. If using a WASM-enabled build, disable the experimental WebAssembly shaper by setting HB_USE_WASM=0 in environment variables. Monitor for crashes or memory corruption in applications using HarfBuzz.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-113679. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart