CVE-2026-113680
MediumCVSS 5.5Summary
HarfBuzz from 8.0.0 through 14.6.0 contains a NULL pointer dereference vulnerability in the experimental WebAssembly shaper host imports buffer_set_contents, face_create, and font_set_coords. A crafted font whose embedded wasm module passes out-of-range addresses with non-zero lengths crashes any application that shapes text with the font.
Risk Assessment
A crafted font can crash the text-shaping application (denial of service), and in some scenarios potentially cause further impact from the NULL dereference.
Recommendation
Update HarfBuzz to a version later than 14.6.0 containing the address validation fix in the wasm imports.
Other vulnerabilities in HarfBuzz
See all- CVE-2026-113679High
HarfBuzz 8.0.0 through 14.6.0 contains an out-of-bounds write in the experimental WebAssembly shaper due to a wrong WAMR signature for the font_glyph_to_string import. An attacker can supply a crafted font whose wasm module places the output buffer near the end of linear memory, writing glyph-name bytes into host memory and crashing or corrupting applications.
- CVE-2015-8947High
HarfBuzz before version 1.0.5 contains a vulnerability that allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via crafted data.
- CVE-2024-56732High
HarfBuzz is a text shaping engine. Starting with versions 8.5.0 through 10.0.1, there is a heap-based buffer overflow in the hb_cairo_glyphs_from_buffer function.
Original NVD description (English source)
HarfBuzz from 8.0.0 through 14.6.0 contains a NULL pointer dereference vulnerability in the experimental WebAssembly shaper host imports buffer_set_contents, face_create, and font_set_coords. Attackers can supply a crafted font whose embedded wasm module passes out-of-range addresses with non-zero lengths, crashing any application that shapes text with the font.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS