CVE-2026-113679
Awaiting Analysis Awaiting Analysis - Queue

Out-of-Bounds Write in HarfBuzz Font Processing

Publication date: 2026-10-20

Last updated on: 2026-10-20

Assigner: VulnCheck

Description
HarfBuzz 8.0.0 through 14.6.0 contains an out-of-bounds write vulnerability in the experimental WebAssembly shaper because the font_glyph_to_string import has a wrong WAMR signature. Attackers can supply a crafted font whose wasm module places the output buffer near linear memory's end, writing glyph-name bytes into host memory to crash or corrupt applications.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-20
Last Modified
2026-10-20
Generated
2026-11-09
AI Q&A
2026-10-20
EPSS Evaluated
2026-11-08
NVD
CVE-2026-113679
EUVD
EUVD-2026-105095

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
harfbuzz harfbuzz 8.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-787 The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an out-of-bounds write flaw in HarfBuzz versions 8.0.0 through 14.6.0. It occurs in the experimental WebAssembly shaper due to an incorrect function signature for font_glyph_to_string. Attackers can exploit this by crafting a font with a WASM module that places the output buffer near linear memory's end, allowing writes beyond allocated memory. This can crash applications or corrupt memory.

Detection Guidance

To detect this vulnerability, check if your system uses HarfBuzz versions 8.0.0 through 14.6.0. Run: harfbuzz-info --version or check package managers like apt list --installed | grep harfbuzz. Inspect WASM-enabled builds for the experimental shaper.

Impact Analysis

If you use applications relying on HarfBuzz (e.g., text rendering libraries), this flaw could allow attackers to crash your software or corrupt memory by providing malicious fonts. This may lead to denial-of-service or potential code execution if combined with other vulnerabilities.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a memory corruption issue in Harfuzz's WebAssembly shaper that could lead to crashes or corruption in applications using affected versions. Compliance impacts would depend on how the vulnerability is exploited in a specific system.

Mitigation Strategies

Upgrade HarfBuzz to a patched version beyond 14.6.0. If using a WASM-enabled build, disable the experimental WebAssembly shaper by setting HB_USE_WASM=0 in environment variables. Monitor for crashes or memory corruption in applications using HarfBuzz.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-113679. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...