CVE-2026-113679
HighCVSS 7.0Summary
HarfBuzz 8.0.0 through 14.6.0 contains an out-of-bounds write in the experimental WebAssembly shaper due to a wrong WAMR signature for the font_glyph_to_string import. An attacker can supply a crafted font whose wasm module places the output buffer near the end of linear memory, writing glyph-name bytes into host memory and crashing or corrupting applications.
Risk Assessment
Processing a malicious font can crash the application or corrupt memory, potentially leading to code execution in the process context.
Recommendation
Upgrade HarfBuzz to a version later than 14.6.0 containing the fix, or avoid processing untrusted fonts with the WebAssembly shaper.
Other vulnerabilities in HarfBuzz
See all- CVE-2026-113680Medium
HarfBuzz from 8.0.0 through 14.6.0 contains a NULL pointer dereference vulnerability in the experimental WebAssembly shaper host imports buffer_set_contents, face_create, and font_set_coords. A crafted font whose embedded wasm module passes out-of-range addresses with non-zero lengths crashes any application that shapes text with the font.
- CVE-2015-8947High
HarfBuzz before version 1.0.5 contains a vulnerability that allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via crafted data.
- CVE-2024-56732High
HarfBuzz is a text shaping engine. Starting with versions 8.5.0 through 10.0.1, there is a heap-based buffer overflow in the hb_cairo_glyphs_from_buffer function.
Original NVD description (English source)
HarfBuzz 8.0.0 through 14.6.0 contains an out-of-bounds write vulnerability in the experimental WebAssembly shaper because the font_glyph_to_string import has a wrong WAMR signature. Attackers can supply a crafted font whose wasm module places the output buffer near linear memory's end, writing glyph-name bytes into host memory to crash or corrupt applications.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS