Live › vulnerability › CVE-2026-113680
Go to dashboardHarfBuzz, the text shaping library, has a NULL pointer dereference in its experimental WebAssembly shaper host imports. A crafted font whose embedded wasm module passes out-of-range addresses with non-zero lengths crashes any application that shapes text with that font.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Applications that shape text with HarfBuzz from 8.0.0 through 14.6.0 and load fonts from untrusted sources are exposed to a crash. The source describes a crash, not code execution, and does not say whether the experimental WebAssembly shaper is enabled by default, so teams that never load untrusted fonts or never enable that shaper can likely skip it. unknown whether the default build includes it.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
HarfBuzz from 8.0.0 through 14.6.0 contains a NULL pointer dereference vulnerability in the experimental WebAssembly shaper host imports buffer_set_contents, face_create, and font_set_coords. Attackers can supply a crafted font whose embedded wasm module passes out-of-range addresses with non-zero lengths, crashing any application that shapes text with the font.
This page as .md · .json · in your agent: get_signal("CVE-2026-113680")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.