Out-of-Bounds Write Vulnerability in HarfBuzz WebAssembly Shaper
CVE-2026-113679

7.3HIGH

Key Information:

Vendor

Harfbuzz

Status
Harfbuzz
Vendor
CVE Published:
20 October 2026

What is CVE-2026-113679?

HarfBuzz versions 8.0.0 to 14.6.0 are affected by an out-of-bounds write vulnerability in the experimental WebAssembly shaper. This issue arises due to an incorrect signature for the font_glyph_to_string import, allowing attackers to craft a malicious font. When exploited, this vulnerability can lead to writing glyph-name bytes into the host memory, potentially causing application crashes or corruptions. It is imperative for users of the affected versions to apply the necessary patches to mitigate this risk.

Affected Version(s)

harfbuzz 8.0.0 <= 14.6.0

References

https://github.com/harfbuzz/harfbuzz/pull/6414
patchissue-tracking
https://github.com/harfbuzz/harfbuzz/commit/5e821de8256d0...
patch
https://github.com/harfbuzz/harfbuzz/blob/14.6.0/src/hb-w...
technical-description

CVSS V4

Score:
7.3
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Aziz Elbelaychy (Ostorlab)
.