CVE-2023-21716

CVE-2023-21716 Microsoft Word RTF Font Table Heap Corruption A vulnerability within Microsoft Office's wwlib allows attackers to achieve remote code execution with the privileges of the victim that opens a malicious RTF document. The attacker could deliver this file as an email attachment or othe...

Palimpsest

CVE-2026-74945 · Uninitialized heap disclosure through a crafted web font This directory holds an honest reproduction package for an uninitialized-memory disclosure in Firefox font handling. A crafted @font-face font walks the OTS output stream into an uninitialized-heap gap, and ordinary content...

confusable-vision

confusable-vision The world's first font-by-font confusables dataset. Which Unicode characters look like which, measured from the fonts' outlines rather than from pixels. The current release, 2026.09.26, compares every letter and digit that each of 322 fonts draws, at the size and baseline positi...

EvilFontTool

EvilFontTool A font-based deception tool for red teaming, security research, and whatever else. EvilFontTool hides machine-readable text inside a document that displays completely different text to a human reader. It does this using Evil Fonts — fonts that intentionally deceive the viewer by...

CVE-2023-21716

CVE-2023-21716 POC : CVE-2023-21716 Microsoft Word RTF Font Table Heap Corruption...

CVE-2020-1020

CVE-2020-1020 Windows Font Driver Type 1 VToHOrigin stack corruption only works on win7 x64...

z80-sans

Z80 Sans What's your favourite disassembler? Mine's a font: https://github.com/user-attachments/assets/bb6ceb18-c2fd-40a9-be4f-202321a214d9 This font converts sequences of hexadecimal lowercase characters into disassembled Z80 instructions, by making extensive use of OpenType's Glyph Substitution...

CVE-2022-28368

CVE-2022-28368 - Dompdf RCE Dompdf RCE PoC Exploit alt text ExploitDB Dompdf versions 1.2.1 are vulnerable to Remote Code Execution RCE by injecting CSS into the data. The file can be tricked into storing a malicious font with a .php file extension in its font cache, which can later be executed b...

CVE-2025-27363

CVE-2025-27363 on Chrome 113 Note: In chrome, this is not a new vulnerability, it was patched roll-up commit in March 2023. This PoC targets only chrome headless mode. However, I think it's an interesting read if you want to explore some internals and see the exploitation on PartitionAlloc when y...

CVE-2024-4367-PoC

CVE-2024-4367 & CVE-2024-34342: Arbitrary JavaScript execution in PDF.js A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js context. This vulnerability affects Firefox 126, Firefox ESR 115.11, and Thunderbird 115.11. If pdf.js is...

CVE-2022-28368-handler

CVE-2022-28368-handler This repository contains a python script that will handle the majority of the dompdf cached font exploit CVE-2022-28368, all you need to do is create the request. It will even provide a trigger string to start the exploit : Usage usage: CVE-2022-28368.py -h -d DOMPDFLOCATIO...

CVE-2025-27363-proof-of-concept

Proof-of-concept for CVE-2025-27363 that crashes FreeType 2.13.0. This modifies Roboto Flex, a variable font, so that the "%" character glyph 8 is now a composite glyph with 0xfffd subglyphs. Rendering the edited font with FreeType 2.13.0 the last version before the fix crashes, with ASAN detecti...

CVE-2026-113500

The LiteSpeed Cache WordPress plugin (versions before 7.9.2 ) is vulnerable to an unauthenticated stored XSS vulnerability. The issue stems from an HTML optimization routine that fails to limit its scope to stylesheet content, potentially deleting the markup that closes attributes in the rendered...

CVE-2026-113500 LiteSpeed Cache < 7.9.2 - Unauthenticated Stored XSS via Font Display Optimization

The LiteSpeed Cache WordPress plugin before 7.9.2 does not limit one of its HTML optimization routines to stylesheet content, so it can delete the markup that closes an attribute in the rendered page, and combined with unescaped comment author output this allows unauthenticated users whose commen...

CVE-2026-111737

The Speed Optimizer WordPress plugin in versions before 7.8.5 is vulnerable to a Stored Cross-Site Scripting (XSS) attack. The root cause is the failure to properly sanitise or escape specific settings before they are outputted in the head section of front-end pages. This flaw allows high-privile...

CVE-2026-111737 Speed Optimizer < 7.8.5 - Admin+ Stored XSS via DNS Prefetch and Font Preload URL Lists

The Speed Optimizer WordPress plugin before 7.8.5 does not sanitise or escape some of its settings before outputting them in the head of front-end pages, which could allow high-privilege users such as admins to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is...

test-cve-2025-29927

This is a Next.js project bootstrapped with create-next-app. Getting Started First, run the development server: npm run dev or yarn dev or pnpm dev or bun dev Open http://localhost:3000 with your browser to see the result. You can start editing the page by modifying app/page.tsx. The page...

WDBFontOverwrite

Proof-of-concept app to overwrite fonts on iOS using CVE-2022-46689. Works on iOS 16.1.2 and below tested on iOS 16.1 on unjailbroken devices. IPA available in the Releases section. Fonts included: DejaVu Sans Condensed DejaVu Serif DejaVu Sans Mono Go Regular Go Mono Fira Sans Segoe UI Comic San...

WordPress MW Font Changer <=4.2.5 - Cross-Site Scripting

WordPress MW Font Changer plugin 4.2.5 and before contains a cross-site scripting vulnerability which allows an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication...

WordPress Admin Font Editor <=1.8 - Cross-Site Scripting

WordPress Admin Font Editor 1.8 and before contains a reflected cross-site scripting vulnerability which allows an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication...