Description
libschrift through 0.10.2 contains a divide by zero vulnerability that allows attackers to crash applications by supplying a font with unitsPerEm of 0 in the head table. Attackers can provide a crafted TrueType font whose NaN glyph coordinates bypass clip_points(), causing an out-of-bounds raster read in draw_line() during sft_render() and crashing the process.
Published: 2026-10-14
Score: 6.8 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Application crash (Denial of Service)
Action: Apply Patch
AI Analysis

Impact

The vulnerability in libschrift up to version 0.10.2 is a divide‑by‑zero condition triggered by a unitsPerEm value of 0 in the font's head table. When the library processes a crafted TrueType font, the NaN glyph coordinates bypass clip_points(), leading to an out‑of‑bounds raster read inside draw_line() during sft_render(). This causes the application to terminate unexpectedly. The weakness is a classic divide‑by‑zero flaw (CWE‑369).

Affected Systems

The affected software is the open‑source libschrift library from tomolt, in all releases through 0.10.2. Any application that loads TrueType fonts via libschrift is vulnerable; no specific system versions are mentioned beyond the library itself.

Risk and Exploitability

The CVSS score is 6.8, indicating a medium severity impact. The EPSS score is 0.00201, indicating a very low exploitation probability, and the vulnerability is not listed in CISA KEV. The attack vector is likely remote or local depending on the application’s font handling; an attacker can supply a malicious font file to the vulnerable program, forcing a crash. The exploit does not require privileged permissions, and the denial of service can affect availability for the target process.

Generated by OpenCVE AI on October 15, 2026 at 21:30 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update libschrift to a version newer than 0.10.2 or apply the vendor’s patch if available.
  • If updating the library is not immediately feasible, configure the application to validate font files and reject any TrueType font whose head table unitsPerEm is zero before rendering.
  • Consider switching to a different font rendering library that does not contain this vulnerability.

Generated by OpenCVE AI on October 15, 2026 at 21:30 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 27 Oct 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 19 Oct 2026 13:30:00 +0000

Type Values Removed Values Added
First Time appeared Tomolt
Tomolt libschrift
Vendors & Products Tomolt
Tomolt libschrift

Wed, 14 Oct 2026 14:30:00 +0000

Type Values Removed Values Added
Description libschrift through 0.10.2 contains a divide by zero vulnerability that allows attackers to crash applications by supplying a font with unitsPerEm of 0 in the head table. Attackers can provide a crafted TrueType font whose NaN glyph coordinates bypass clip_points(), causing an out-of-bounds raster read in draw_line() during sft_render() and crashing the process.
Title libschrift through 0.10.2 Divide by Zero via unitsPerEm in draw_line
Weaknesses CWE-369
References
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'}

cvssV4_0

{'score': 6.8, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Tomolt Libschrift
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-26T16:17:20.314Z

Reserved: 2026-10-14T13:07:21.881Z

Link: CVE-2026-110605

cve-icon Vulnrichment

Updated: 2026-10-26T16:16:22.255Z

cve-icon NVD

Status : Deferred

Published: 2026-10-14T15:17:12.160

Modified: 2026-10-26T17:17:14.607

Link: CVE-2026-110605

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-19T13:08:39Z

Weaknesses