{"id":"CVE-2026-113679","kind":"vulnerability","aliases":["CVE-2026-113679"],"related":[],"title":"HarfBuzz: crafted font writes out of bounds in WebAssembly shaper","description":"HarfBuzz 8.0.0 through 14.6.0 contains an out-of-bounds write vulnerability in the experimental WebAssembly shaper because the font_glyph_to_string import has a wrong WAMR signature. Attackers can supply a crafted font whose wasm module places the output buffer near linear memory's end, writing glyph-name bytes into host memory to crash or corrupt applications.","summary":"HarfBuzz, a text shaping library, has an out-of-bounds write in its experimental WebAssembly shaper caused by a wrong WAMR function signature for the font_glyph_to_string import. A crafted font can place the output buffer at the end of linear memory so glyph-name bytes are written into host memory, crashing or corrupting the application.","severity":"high","cvss":7.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["browsers","c-libraries","desktop-apps","harfbuzz","package","text-rendering"],"not_affected_if":["default-config","trusted-fonts-only"],"how_to_check":"- Check the installed HarfBuzz version with `hb-shape --version` or your package manager; affected range is `8.0.0` through `14.6.0`.\n- Check whether the build enables the experimental WebAssembly shaper (WAMR-based), which the sources tie to the flaw.","fix":"- Move HarfBuzz to a version later than `14.6.0`; the sources do not name the exact fixed release, so confirm it on the project's release page.\n- Until patched, unknown whether disabling the WebAssembly shaper fully removes exposure; the sources do not say.","status":"open","published_at":"2026-10-20T16:17:12+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","triaged_at":"2026-10-25T03:27:29+00:00","updated_at":"2026-10-25T03:27:29+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:27:29Z","model":"claude-haiku-5-5","output":{"fix":"- Move HarfBuzz to a version later than `14.6.0`; the sources do not name the exact fixed release, so confirm it on the project's release page.\n- Until patched, unknown whether disabling the WebAssembly shaper fully removes exposure; the sources do not say.","reach":"unknown","title":"HarfBuzz: crafted font writes out of bounds in WebAssembly shaper","impact":"medium","summary":"HarfBuzz, a text shaping library, has an out-of-bounds write in its experimental WebAssembly shaper caused by a wrong WAMR function signature for the font_glyph_to_string import. A crafted font can place the output buffer at the end of linear memory so glyph-name bytes are written into host memory, crashing or corrupting the application.","category":"package","nicknames":[],"who_cares":["harfbuzz","text-rendering","browsers","desktop-apps","c-libraries"],"confidence":0.6,"needs_auth":"no","worst_case":"Crafted font crashes application or corrupts host memory.","analyst_note":"Confirm the fixed HarfBuzz version and whether the WebAssembly shaper is built by default, via the NVD entry and the HarfBuzz project release notes.","how_to_check":"- Check the installed HarfBuzz version with `hb-shape --version` or your package manager; affected range is `8.0.0` through `14.6.0`.\n- Check whether the build enables the experimental WebAssembly shaper (WAMR-based), which the sources tie to the flaw.","needs_analyst":true,"not_affected_if":["trusted-fonts-only","default-config"],"who_is_affected":"Applications that load untrusted fonts through HarfBuzz builds in the affected range are exposed, most plausibly those that enable the experimental WebAssembly shaper. Systems that only shape trusted, bundled fonts with default builds are less exposed. The sources do not say whether default builds include the WebAssembly shaper.","user_interaction":"unknown","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.00069,"input_tokens":3365,"output_tokens":707,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-113679':13A,16A '-2026':12A,15A '14.6.0':92C '8.0.0':90C 'app':23B 'applic':88B,148C 'attack':118C 'bound':7A,39B,98C 'browser':17B 'buffer':67B,130C 'byte':78B,140C 'c':19B 'c-librari':18B 'caus':46B 'contain':93C 'corrupt':86B,147C 'craft':2A,61B,122C 'crash':84B,145C 'cve':11A,14A 'desktop':22B 'desktop-app':21B 'end':70B,135C 'experiment':43B,103C 'font':3A,55B,62B,108C,123C 'function':51B 'glyph':56B,76B,109C,138C 'glyph-nam':75B,137C 'harfbuzz':1A,24B,29B,89C 'host':82B,142C 'import':59B,112C 'librari':20B,33B 'linear':72B,132C 'memori':73B,83B,133C,143C 'modul':126C 'name':77B,139C 'near':131C 'out-of-bound':36B,95C 'output':66B,129C 'packag':25B 'place':64B,127C 'render':28B 'shape':32B 'shaper':10A,45B,105C 'signatur':52B,117C 'string':58B,111C 'suppli':120C 'text':27B,31B 'text-rend':26B 'vulner':100C 'wamr':50B,116C 'wasm':125C 'webassembl':9A,44B,104C 'whose':124C 'write':4A,40B,99C,136C 'written':80B 'wrong':49B,115C","nicknames":[],"mitigations":[],"who_affected":"Applications that load untrusted fonts through HarfBuzz builds in the affected range are exposed, most plausibly those that enable the experimental WebAssembly shaper. Systems that only shape trusted, bundled fonts with default builds are less exposed. The sources do not say whether default builds include the WebAssembly shaper.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T16:17:12+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113679","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113679","severity":null,"published_at":"2026-10-20T16:17:12+00:00","modified_at":"2026-10-20T20:06:37+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}