CVE-2026-113680: HarfBuzz 8.0.0 through 14.6.0 WebAssembly Shaper NULL Pointer Dereference DoS
HarfBuzz from 8.0.0 through 14.6.0 contains a NULL pointer dereference vulnerability in the experimental WebAssembly shaper host imports buffersetcontents, facecreate, and fontsetcoords. Attackers can supply a crafted font whose embedded wasm module passes out-of-range addresses with non-zero lengths, crashing any application that shapes text with the font.
Affected Software
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications using HarfBuzz versions 8.0.0 through 14.6.0 are exposed when they shape text using a font that contains an embedded WebAssembly module and reaches the experimental WebAssembly shaper host imports.
What does an attacker need to provide to trigger the crash?
The attacker needs to supply a crafted font with an embedded wasm module. The module passes out-of-range addresses with non-zero lengths to buffer_set_contents, face_create, or font_set_coords, causing a NULL pointer dereference.
How can I determine whether my deployment is affected?
Check whether the deployed HarfBuzz version falls between 8.0.0 and 14.6.0, inclusive. Then determine whether the application may process attacker-supplied fonts or otherwise use the experimental WebAssembly shaper functionality.