Heap Out-of-Bounds Vulnerability in node-fontnik by Mapbox

CVE-2026-63660

What is CVE-2026-63660?

The node-fontnik library, used for rendering glyphs as signed distance fields (SDFs), is susceptible to a heap out-of-bounds vulnerability. This flaw arises when a specially crafted font triggers a corruption in memory during the rendering process. Specifically, the RenderSDF function calculates bitmap allocation based on the glyph dimensions derived from the font's outline bounding box; however, it lacks an upper bound check. This oversight allows for extremely large glyph dimensions, leading to buffer under-allocation and subsequent memory corruption. The issue, which has been resolved in version 0.7.7, can be exploited with a small enough font size to wrap the allocation size to a minimal value, thereby causing the application to crash.

References