CVE-2026-113679: HarfBuzz 8.0.0 through 14.6.0 Out-of-Bounds Write via WebAssembly font_glyph_to_string
HarfBuzz 8.0.0 through 14.6.0 contains an out-of-bounds write vulnerability in the experimental WebAssembly shaper because the fontglyphtostring import has a wrong WAMR signature. Attackers can supply a crafted font whose wasm module places the output buffer near linear memory's end, writing glyph-name bytes into host memory to crash or corrupt applications.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
The issue affects HarfBuzz versions 8.0.0 through 14.6.0 when the experimental WebAssembly shaper processes a crafted font containing a WebAssembly module. The provided information does not establish whether the experimental shaper is enabled or used by default.
What does an attacker need to exploit it?
An attacker needs to cause the application to process a crafted font whose WebAssembly module positions its output buffer near the end of linear memory. The attack requires user interaction according to the supplied vector, but no privileges are required.
What could successful exploitation cause?
Glyph-name bytes can be written into host memory outside the intended bounds. This can crash the application or corrupt memory, with high confidentiality, integrity, and availability impact indicated by the supplied vector.
How can I determine whether my environment is affected?
Identify whether your application ships HarfBuzz 8.0.0 through 14.6.0 and processes untrusted fonts using the experimental WebAssembly shaper. The vulnerable path involves the font_glyph_to_string import and its WAMR signature.