{"id":"CVE-2026-113680","kind":"vulnerability","aliases":["CVE-2026-113680"],"related":[],"title":"HarfBuzz: crafted font crashes apps that shape text with it","description":"HarfBuzz from 8.0.0 through 14.6.0 contains a NULL pointer dereference vulnerability in the experimental WebAssembly shaper host imports buffer_set_contents, face_create, and font_set_coords. Attackers can supply a crafted font whose embedded wasm module passes out-of-range addresses with non-zero lengths, crashing any application that shapes text with the font.","summary":"HarfBuzz, the text shaping library, has a NULL pointer dereference in its experimental WebAssembly shaper host imports. A crafted font whose embedded wasm module passes out-of-range addresses with non-zero lengths crashes any application that shapes text with that font.","severity":"medium","cvss":6.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["browsers","font-handling","harfbuzz","package","text-rendering"],"not_affected_if":["trusted-fonts-only"],"how_to_check":"- unknown","fix":"- unknown","status":"open","published_at":"2026-10-20T16:17:12+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","triaged_at":"2026-10-25T03:44:41+00:00","updated_at":"2026-10-25T03:44:41+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-25T03:44:41Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"unknown","title":"HarfBuzz: crafted font crashes apps that shape text with it","impact":"low","summary":"HarfBuzz, the text shaping library, has a NULL pointer dereference in its experimental WebAssembly shaper host imports. A crafted font whose embedded wasm module passes out-of-range addresses with non-zero lengths crashes any application that shapes text with that font.","category":"package","nicknames":[],"who_cares":["harfbuzz","text-rendering","browsers","font-handling"],"confidence":0.5,"needs_auth":"no","worst_case":"Application crashes while shaping text with a malicious font","analyst_note":"Check the NVD entry and the HarfBuzz upstream advisory for the fixed version and whether the experimental WebAssembly shaper is enabled by default.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["trusted-fonts-only"],"who_is_affected":"Applications that shape text with HarfBuzz from 8.0.0 through 14.6.0 and load fonts from untrusted sources are exposed to a crash. The source describes a crash, not code execution, and does not say whether the experimental WebAssembly shaper is enabled by default, so teams that never load untrusted fonts or never enable that shaper can likely skip it. unknown whether the default build includes it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000592,"input_tokens":3364,"output_tokens":512,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-113680':11A,14A '-2026':10A,13A '14.6.0':72C '8.0.0':70C 'address':53B,110C 'app':5A 'applic':61B,118C 'attack':95C 'browser':15B 'buffer':86C 'contain':73C 'content':88C 'coord':94C 'craft':2A,42B,99C 'crash':4A,59B,116C 'creat':90C 'cve':9A,12A 'derefer':33B,77C 'embed':45B,102C 'experiment':36B,81C 'face':89C 'font':3A,17B,43B,67B,92C,100C,124C 'font-handl':16B 'handl':18B 'harfbuzz':1A,19B,24B,68C 'host':39B,84C 'import':40B,85C 'length':58B,115C 'librari':28B 'modul':47B,104C 'non':56B,113C 'non-zero':55B,112C 'null':31B,75C 'out-of-rang':49B,106C 'packag':20B 'pass':48B,105C 'pointer':32B,76C 'rang':52B,109C 'render':23B 'set':87C,93C 'shape':7A,27B,63B,120C 'shaper':38B,83C 'suppli':97C 'text':8A,22B,26B,64B,121C 'text-rend':21B 'vulner':78C 'wasm':46B,103C 'webassembl':37B,82C 'whose':44B,101C 'zero':57B,114C","nicknames":[],"mitigations":[],"who_affected":"Applications that shape text with HarfBuzz from 8.0.0 through 14.6.0 and load fonts from untrusted sources are exposed to a crash. The source describes a crash, not code execution, and does not say whether the experimental WebAssembly shaper is enabled by default, so teams that never load untrusted fonts or never enable that shaper can likely skip it. unknown whether the default build includes it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T16:17:12+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113680","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113680","severity":null,"published_at":"2026-10-20T16:17:12+00:00","modified_at":"2026-10-21T16:17:24+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}