9 matches found
CVE-2026-113679
A flaw was found in HarfBuzz. An attacker can trigger an out-of-bounds write by enticing an application using the experimental WebAssembly Wasm shaper to process a specially crafted font. Due to an incorrect function signature in the glyph string conversion interface, the font's embedded...
CVE-2026-113679
HarfBuzz 8.0.0 through 14.6.0 contains an out-of-bounds write vulnerability in the experimental WebAssembly shaper because the fontglyphtostring import has a wrong WAMR signature. Attackers can supply a crafted font whose wasm module places the output buffer near linear memory's end, writing...
CVE-2026-113680 HarfBuzz 8.0.0 through 14.6.0 WebAssembly Shaper NULL Pointer Dereference DoS
HarfBuzz from 8.0.0 through 14.6.0 contains a NULL pointer dereference vulnerability in the experimental WebAssembly shaper host imports buffersetcontents, facecreate, and fontsetcoords. Attackers can supply a crafted font whose embedded wasm module passes out-of-range addresses with non-zero...
CVE-2026-113680 HarfBuzz 8.0.0 through 14.6.0 WebAssembly Shaper NULL Pointer Dereference DoS
HarfBuzz from 8.0.0 through 14.6.0 contains a NULL pointer dereference vulnerability in the experimental WebAssembly shaper host imports buffersetcontents, facecreate, and fontsetcoords. Attackers can supply a crafted font whose embedded wasm module passes out-of-range addresses with non-zero...
CVE-2026-113680
The HarfBuzz library, versions 8.0.0 through 14.6.0 , contains a NULL pointer dereference vulnerability within the experimental WebAssembly shaper host imports, specifically affecting buffer_set_contents, face_create, and font_set_coords. A remote attacker can trigger a Denial of Service (DoS) by...
CVE-2026-113679 HarfBuzz 8.0.0 through 14.6.0 Out-of-Bounds Write via WebAssembly font_glyph_to_string
HarfBuzz 8.0.0 through 14.6.0 contains an out-of-bounds write vulnerability in the experimental WebAssembly shaper because the fontglyphtostring import has a wrong WAMR signature. Attackers can supply a crafted font whose wasm module places the output buffer near linear memory's end, writing...
CVE-2026-113679
The HarfBuzz library versions 8.0.0 through 14.6.0 are susceptible to an out-of-bounds write vulnerability within the experimental WebAssembly shaper . The root cause is an incorrect WAMR signature in the font_glyph_to_string import. An attacker can provide a crafted font containing a WebAssembly...
CVE-2026-113679 HarfBuzz 8.0.0 through 14.6.0 Out-of-Bounds Write via WebAssembly font_glyph_to_string
HarfBuzz 8.0.0 through 14.6.0 contains an out-of-bounds write vulnerability in the experimental WebAssembly shaper because the fontglyphtostring import has a wrong WAMR signature. Attackers can supply a crafted font whose wasm module places the output buffer near linear memory's end, writing...
EUVD-2026-105095
HarfBuzz 8.0.0 through 14.6.0 contains an out-of-bounds write vulnerability in the experimental WebAssembly shaper because the fontglyphtostring import has a wrong WAMR signature. Attackers can supply a crafted font whose wasm module places the output buffer near linear memory's end, writing...