{"id":"CVE-2026-110605","summary":"libschrift through 0.10.2 Divide by Zero via unitsPerEm in draw_line","details":"libschrift through 0.10.2 contains a divide by zero vulnerability that allows attackers to crash applications by supplying a font with unitsPerEm of 0 in the head table. Attackers can provide a crafted TrueType font whose NaN glyph coordinates bypass clip_points(), causing an out-of-bounds raster read in draw_line() during sft_render() and crashing the process.","modified":"2026-10-15T02:47:29.245291846Z","published":"2026-10-14T14:16:45.714Z","database_specific":{"cna_assigner":"VulnCheck","cwe_ids":["CWE-369"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/110xxx/CVE-2026-110605.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/110xxx/CVE-2026-110605.json"},{"type":"PACKAGE","url":"https://github.com/tomolt/libschrift"},{"type":"ARTICLE","url":"https://github.com/tomolt/libschrift/blob/v0.10.2/schrift.c#L1422-L1503"},{"type":"ARTICLE","url":"https://github.com/tomolt/libschrift/blob/v0.10.2/schrift.c#L542"},{"type":"REPORT","url":"https://github.com/tomolt/libschrift/issues/46"},{"type":"ADVISORY","url":"https://hackmd.io/@haind-pwn/libschrift-unitsperem-zero-oob"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110605"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/libschrift-through-0.10.2-divide-by-zero-via-unitsperem-in-draw-line"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/tomolt/libschrift","events":[{"introduced":"0"},{"last_affected":"8e533fd07acc2f8ae4cffe7f95d2c3392773e2b5"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"last_affected":"0.10.2"}],"source":"AFFECTED_FIELD"}}],"versions":["v0.10.2","v0.10.1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-110605.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}]}