HarfBuzz versions 8.0.0 through 14.6.0 contain an out-of-bounds write flaw in the experimental WebAssembly shaper. The font_glyph_to_string import has an incorrect WAMR signature, allowing a crafted font to place its output buffer near the end of linear memory. The resulting write deposits glyph-name bytes into host memory, corrupting data or crashing the host application. This vulnerability corresponds to CWE‑787 and can lead to loss of integrity and availability of the affected process, and in certain circumstances could facilitate arbitrary code execution if the attacker can influence the memory layout.

The affected product is the HarfBuzz text shaping library, as distributed by the HarfBuzz project. All releases in the 8.0.0 through 14.6.0 series are susceptible. Applications that link against these library versions and employ the experimental WebAssembly shaper expose their runtime to the flaw.

The CVSS score is 7.3, indicating a high severity with moderate to high impact. No EPSS score is available, and the vulnerability is not listed in CISA’s KEV catalogue, implying no publicly known exploits at this time. The likely attack vector is a crafted font file supplied to an application that uses HarfBuzz with the WebAssembly shaper enabled. Successful exploitation requires that the application loads the vulnerable library and processes a font whose wasm module positions its output buffer near the end of linear memory.