Live › vulnerability › CVE-2026-113679
Go to dashboardHarfBuzz, a text shaping library, has an out-of-bounds write in its experimental WebAssembly shaper caused by a wrong WAMR function signature for the font_glyph_to_string import. A crafted font can place the output buffer at the end of linear memory so glyph-name bytes are written into host memory, crashing or corrupting the application.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Applications that load untrusted fonts through HarfBuzz builds in the affected range are exposed, most plausibly those that enable the experimental WebAssembly shaper. Systems that only shape trusted, bundled fonts with default builds are less exposed. The sources do not say whether default builds include the WebAssembly shaper.
No product ranges from the sources yet.
hb-shape --version or your package manager; affected range is 8.0.0 through 14.6.0.14.6.0; the sources do not name the exact fixed release, so confirm it on the project's release page.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
HarfBuzz 8.0.0 through 14.6.0 contains an out-of-bounds write vulnerability in the experimental WebAssembly shaper because the font_glyph_to_string import has a wrong WAMR signature. Attackers can supply a crafted font whose wasm module places the output buffer near linear memory's end, writing glyph-name bytes into host memory to crash or corrupt applications.
This page as .md · .json · in your agent: get_signal("CVE-2026-113679")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.