NULL Pointer Dereference in HarfBuzz WebAssembly Shaper Components
CVE-2026-113680

6.8MEDIUM

Key Information:

Vendor

Harfbuzz

Status
Harfbuzz
Vendor
CVE Published:
20 October 2026

What is CVE-2026-113680?

HarfBuzz versions ranging from 8.0.0 through 14.6.0 exhibit a NULL pointer dereference vulnerability in the experimental WebAssembly shaper's host imports. Specifically, the functions 'buffer_set_contents', 'face_create', and 'font_set_coords' are affected. This vulnerability allows attackers to create a specially crafted font containing an embedded WebAssembly module that can exploit out-of-range addresses with non-zero lengths, leading to crashes in any application that processes text with the affected font. Developers using these versions should apply the recommended patches to mitigate this issue.

Affected Version(s)

harfbuzz 8.0.0 <= 14.6.0

References

https://github.com/harfbuzz/harfbuzz/pull/6414
patchissue-tracking
https://github.com/harfbuzz/harfbuzz/commit/a71aa86c2bac1...
patch
https://github.com/harfbuzz/harfbuzz/blob/14.6.0/src/hb-w...
technical-description

CVSS V4

Score:
6.8
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Aziz Elbelaychy (Ostorlab)
.