CVE-2026-113679
published 2026-10-20CVE-2026-113679: HarfBuzz 8.0.0 through 14.6.0 contains an out-of-bounds write vulnerability in the experimental WebAssembly shaper because the font_glyph_to_string import has…
PriorityP433high7CVSS 3.1
AVLACHPRNUIRSUCHIHAH
EPSS
0.17%
5.5th percentile
HarfBuzz 8.0.0 through 14.6.0 contains an out-of-bounds write vulnerability in the experimental WebAssembly shaper because the font_glyph_to_string import has a wrong WAMR signature. Attackers can supply a crafted font whose wasm module places the output buffer near linear memory's end, writing glyph-name bytes into host memory to crash or corrupt applications.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| harfbuzz | harfbuzz | 8.0.0 – 14.6.0 | — |
| harfbuzz_project | harfbuzz | — | — |
CVSS provenance
nvdv3.17.0HIGHCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv4.07.3HIGHCVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat7.0HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
HarfBuzz 8.0.0 through 14.6.0 contains an out-of-bounds write vulnerability in the experimental WebAssembly shaper because the font_glyph_to_string import has a wrong WAMR signature.
ghsa_unreviewed·2026-10-20
CVE-2026-113679 [HIGH] CWE-787 HarfBuzz 8.0.0 through 14.6.0 contains an out-of-bounds write vulnerability in the experimental WebAssembly shaper because the font_glyph_to_string import has a wrong WAMR signature.
HarfBuzz 8.0.0 through 14.6.0 contains an out-of-bounds write vulnerability in the experimental WebAssembly shaper because the font_glyph_to_string import has a wrong WAMR signature. Attackers can supply a crafted font whose wasm module places the output buffer near linear memory's end, writing glyph-name bytes into host memory to crash or corrupt applications.
Red Hat
harfbuzz: HarfBuzz: Out-of-bounds write via crafted font in WebAssembly shaper
vendor_redhat·2026-10-20·CVSS 7.0
CVE-2026-113679 [HIGH] CWE-787 harfbuzz: HarfBuzz: Out-of-bounds write via crafted font in WebAssembly shaper
harfbuzz: HarfBuzz: Out-of-bounds write via crafted font in WebAssembly shaper
A flaw was found in HarfBuzz. An attacker can trigger an out-of-bounds write by enticing an application using the experimental WebAssembly (Wasm) shaper to process a specially crafted font. Due to an incorrect function signature in the glyph string conversion interface, the font's embedded WebAssembly module can write data past allocated buffer boundaries into host memory. This can lead to memory corruption, an application crash resulting in a Denial of Service (DoS), or potentially arbitrary code execution.
Mitigation: --- CME Mitigation Guidance (2026-10-20) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-113679 mingw-harfbuzz: HarfBuzz: Out-of-bounds write via crafted font in WebAssembly shaper [fedora-44]
bugzilla·2026-10-22·CVSS 7.0
CVE-2026-113679 [HIGH] CVE-2026-113679 mingw-harfbuzz: HarfBuzz: Out-of-bounds write via crafted font in WebAssembly shaper [fedora-44]
CVE-2026-113679 mingw-harfbuzz: HarfBuzz: Out-of-bounds write via crafted font in WebAssembly shaper [fedora-44]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
HarfBuzz 8.0.0 through 14.6.0 contains an out-of-bounds write vulnerability in the experimental WebAssembly shaper because the font_glyph_to_string import has a wrong WAMR signature. Attackers can supply a crafted font whose wasm module places the output buffer near linear memory's end, writing glyph-name bytes into host memory to crash or corrupt applications.
Bugzilla
CVE-2026-113679 harfbuzz: HarfBuzz: Out-of-bounds write via crafted font in WebAssembly shaper [fedora-rawhide]
bugzilla·2026-10-22·CVSS 7.0
CVE-2026-113679 [HIGH] CVE-2026-113679 harfbuzz: HarfBuzz: Out-of-bounds write via crafted font in WebAssembly shaper [fedora-rawhide]
CVE-2026-113679 harfbuzz: HarfBuzz: Out-of-bounds write via crafted font in WebAssembly shaper [fedora-rawhide]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
HarfBuzz 8.0.0 through 14.6.0 contains an out-of-bounds write vulnerability in the experimental WebAssembly shaper because the font_glyph_to_string import has a wrong WAMR signature. Attackers can supply a crafted font whose wasm module places the output buffer near linear memory's end, writing glyph-name bytes into host memory to crash or corrupt applications.
Bugzilla
CVE-2026-113679 mingw-harfbuzz: HarfBuzz: Out-of-bounds write via crafted font in WebAssembly shaper [fedora-rawhide]
bugzilla·2026-10-22·CVSS 7.0
CVE-2026-113679 [HIGH] CVE-2026-113679 mingw-harfbuzz: HarfBuzz: Out-of-bounds write via crafted font in WebAssembly shaper [fedora-rawhide]
CVE-2026-113679 mingw-harfbuzz: HarfBuzz: Out-of-bounds write via crafted font in WebAssembly shaper [fedora-rawhide]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
HarfBuzz 8.0.0 through 14.6.0 contains an out-of-bounds write vulnerability in the experimental WebAssembly shaper because the font_glyph_to_string import has a wrong WAMR signature. Attackers can supply a crafted font whose wasm module places the output buffer near linear memory's end, writing glyph-name bytes into host memory to crash or corrupt applications.
Bugzilla
CVE-2026-113679 harfbuzz: HarfBuzz: Out-of-bounds write via crafted font in WebAssembly shaper [fedora-44]
bugzilla·2026-10-22·CVSS 7.0
CVE-2026-113679 [HIGH] CVE-2026-113679 harfbuzz: HarfBuzz: Out-of-bounds write via crafted font in WebAssembly shaper [fedora-44]
CVE-2026-113679 harfbuzz: HarfBuzz: Out-of-bounds write via crafted font in WebAssembly shaper [fedora-44]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
HarfBuzz 8.0.0 through 14.6.0 contains an out-of-bounds write vulnerability in the experimental WebAssembly shaper because the font_glyph_to_string import has a wrong WAMR signature. Attackers can supply a crafted font whose wasm module places the output buffer near linear memory's end, writing glyph-name bytes into host memory to crash or corrupt applications.
Bugzilla
CVE-2026-113679 harfbuzz: HarfBuzz: Out-of-bounds write via crafted font in WebAssembly shaper [fedora-43]
bugzilla·2026-10-22·CVSS 7.0
CVE-2026-113679 [HIGH] CVE-2026-113679 harfbuzz: HarfBuzz: Out-of-bounds write via crafted font in WebAssembly shaper [fedora-43]
CVE-2026-113679 harfbuzz: HarfBuzz: Out-of-bounds write via crafted font in WebAssembly shaper [fedora-43]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
HarfBuzz 8.0.0 through 14.6.0 contains an out-of-bounds write vulnerability in the experimental WebAssembly shaper because the font_glyph_to_string import has a wrong WAMR signature. Attackers can supply a crafted font whose wasm module places the output buffer near linear memory's end, writing glyph-name bytes into host memory to crash or corrupt applications.
Bugzilla
CVE-2026-113679 mingw-harfbuzz: HarfBuzz: Out-of-bounds write via crafted font in WebAssembly shaper [fedora-43]
bugzilla·2026-10-22·CVSS 7.0
CVE-2026-113679 [HIGH] CVE-2026-113679 mingw-harfbuzz: HarfBuzz: Out-of-bounds write via crafted font in WebAssembly shaper [fedora-43]
CVE-2026-113679 mingw-harfbuzz: HarfBuzz: Out-of-bounds write via crafted font in WebAssembly shaper [fedora-43]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
HarfBuzz 8.0.0 through 14.6.0 contains an out-of-bounds write vulnerability in the experimental WebAssembly shaper because the font_glyph_to_string import has a wrong WAMR signature. Attackers can supply a crafted font whose wasm module places the output buffer near linear memory's end, writing glyph-name bytes into host memory to crash or corrupt applications.
Bugzilla
CVE-2026-113679 harfbuzz: HarfBuzz: Out-of-bounds write via crafted font in WebAssembly shaper
bugzilla·2026-10-20·CVSS 7.0
CVE-2026-113679 [HIGH] CVE-2026-113679 harfbuzz: HarfBuzz: Out-of-bounds write via crafted font in WebAssembly shaper
CVE-2026-113679 harfbuzz: HarfBuzz: Out-of-bounds write via crafted font in WebAssembly shaper
HarfBuzz 8.0.0 through 14.6.0 contains an out-of-bounds write vulnerability in the experimental WebAssembly shaper because the font_glyph_to_string import has a wrong WAMR signature. Attackers can supply a crafted font whose wasm module places the output buffer near linear memory's end, writing glyph-name bytes into host memory to crash or corrupt applications.
https://github.com/harfbuzz/harfbuzz/blob/14.6.0/src/hb-wasm-api-font.hh#L115-L123https://github.com/harfbuzz/harfbuzz/blob/14.6.0/src/hb-wasm-api-list.hh#L85https://github.com/harfbuzz/harfbuzz/commit/5e821de8256d01780566b5c8ab7886fae4c93da8https://github.com/harfbuzz/harfbuzz/pull/6414https://www.vulncheck.com/advisories/harfbuzz-8.0.0-through-14.6.0-out-of-bounds-write-via-webassembly-font-glyph-to-string
2026-10-20
Published