CVE-2026-113679
Description
A flaw was found in HarfBuzz. An attacker can trigger an out-of-bounds write by enticing an application using the experimental WebAssembly (Wasm) shaper to process a specially crafted font. Due to an incorrect function signature in the glyph string conversion interface, the font's embedded WebAssembly module can write data past allocated buffer boundaries into host memory. This can lead to memory corruption, an application crash resulting in a Denial of Service (DoS), or potentially arbitrary code execution.
Statement
An out-of-bounds write flaw was found in HarfBuzz's experimental WebAssembly (Wasm) shaper. When an application using this shaper processes a specially crafted font containing a malicious Wasm module, an incorrect function signature in the glyph-to-string interface allows the module to write data beyond linear memory limits directly into host memory. A local attacker enticing a user or automated service to render a malicious font can cause memory corruption, triggering an application crash (Denial of Service) or potentially arbitrary code execution within the execution context and permissions of the host process.
Mitigation
Disable or avoid compiling the experimental WebAssembly shaper in HarfBuzz environments where untrusted fonts are processed. Restrict host applications and rendering pipelines from loading unverified external font files.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7 | N/A | 7 |
| Attack Vector | Local | N/A | Local |
| Attack Complexity | High | N/A | High |
| Privileges Required | None | N/A | None |
| User Interaction | Required | N/A | Required |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | High | N/A | High |
| Integrity Impact | High | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
cve.org: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
