CVE-2026-110605: libschrift through 0.10.2 Divide by Zero via unitsPerEm in draw_line
libschrift through 0.10.2 contains a divide by zero vulnerability that allows attackers to crash applications by supplying a font with unitsPerEm of 0 in the head table. Attackers can provide a crafted TrueType font whose NaN glyph coordinates bypass clippoints(), causing an out-of-bounds raster read in drawline() during sftrender() and crashing the process.
Affected Software
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications using libschrift through 0.10.2 are exposed when they render attacker-supplied or otherwise untrusted TrueType fonts. The impact described is a process crash during sft_render().
What must an attacker provide to trigger the crash?
The attacker must supply a crafted TrueType font with unitsPerEm set to 0 in its head table. The malformed font can produce NaN glyph coordinates that bypass clip_points() and reach an out-of-bounds raster read in draw_line().
What is the expected impact of successful exploitation?
Successful exploitation crashes the affected process, resulting in a denial of service. No confidentiality or integrity impact is described.