Description
HarfBuzz from 8.0.0 through 14.6.0 contains a NULL pointer dereference vulnerability in the experimental WebAssembly shaper host imports buffer_set_contents, face_create, and font_set_coords. Attackers can supply a crafted font whose embedded wasm module passes out-of-range addresses with non-zero lengths, crashing any application that shapes text with the font.
Published: 2026-10-20
Score: 6.8 Medium
EPSS: n/a
KEV: No
Impact: Denial of Service
Action: Apply Patch
AI Analysis

Impact

Harfbuzz versions 8.0.0 through 14.6.0 contain a NULL pointer dereference in the experimental WebAssembly shaper host imports buffer_set_contents, face_create, and font_set_coords. If an attacker supplies a font whose embedded WebAssembly module specifies out-of-range addresses with non-zero lengths, the library dereferences a null pointer, causing the application that performs text shaping with that font to crash. This results in a denial of service for the affected application.

Affected Systems

Harfbuzz, versions 8.0.0 through 14.6.0, distributed by the Harfbuzz project.

Risk and Exploitability

The CVSS score of 6.8 indicates medium severity. No EPSS data is available, suggesting that publicly known exploitation activity, if any, has not been reported. The vulnerability is not listed in the CISA KEV catalog. Attackers can trigger the flaw by introducing a malicious font file into any environment that loads the WebAssembly shaper host imports; the likely vector involves an application that processes user-supplied fonts, which may be local or remote depending on the usage context.

Generated by OpenCVE AI on October 20, 2026 at 17:57 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade to the latest Harfbuzz release that contains the fix for the WebAssembly shaper host imports
  • If upgrading is not immediately possible, disable the WebAssembly shaper feature or fall back to a non-WebAssembly shaper implementation
  • Validate or sanitize font files to ensure that embedded WebAssembly modules do not contain out-of-range addresses or other malformed data

Generated by OpenCVE AI on October 20, 2026 at 17:57 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 20 Oct 2026 15:45:00 +0000

Type Values Removed Values Added
Description HarfBuzz from 8.0.0 through 14.6.0 contains a NULL pointer dereference vulnerability in the experimental WebAssembly shaper host imports buffer_set_contents, face_create, and font_set_coords. Attackers can supply a crafted font whose embedded wasm module passes out-of-range addresses with non-zero lengths, crashing any application that shapes text with the font.
Title HarfBuzz 8.0.0 through 14.6.0 WebAssembly Shaper NULL Pointer Dereference DoS
First Time appeared Harfbuzz Project
Harfbuzz Project harfbuzz
Weaknesses CWE-476
CPEs cpe:2.3:a:harfbuzz_project:harfbuzz:*:*:*:*:*:*:*:*
Vendors & Products Harfbuzz Project
Harfbuzz Project harfbuzz
References
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'}

cvssV4_0

{'score': 6.8, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Harfbuzz Project Harfbuzz
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-20T15:40:41.101Z

Reserved: 2026-10-20T14:51:02.127Z

Link: CVE-2026-113680

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-20T16:17:12.923

Modified: 2026-10-20T16:17:12.923

Link: CVE-2026-113680

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-20T18:00:16Z

Weaknesses