{"id":"CVE-2026-113679","summary":"HarfBuzz 8.0.0 through 14.6.0 Out-of-Bounds Write via WebAssembly font_glyph_to_string","details":"HarfBuzz 8.0.0 through 14.6.0 contains an out-of-bounds write vulnerability in the experimental WebAssembly shaper because the font_glyph_to_string import has a wrong WAMR signature. Attackers can supply a crafted font whose wasm module places the output buffer near linear memory's end, writing glyph-name bytes into host memory to crash or corrupt applications.","modified":"2026-10-21T09:08:19.791502329Z","published":"2026-10-20T15:40:40.379Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/113xxx/CVE-2026-113679.json","cna_assigner":"VulnCheck","cwe_ids":["CWE-787"]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/113xxx/CVE-2026-113679.json"},{"type":"PACKAGE","url":"https://github.com/harfbuzz/harfbuzz"},{"type":"ARTICLE","url":"https://github.com/harfbuzz/harfbuzz/blob/14.6.0/src/hb-wasm-api-font.hh#L115-L123"},{"type":"ARTICLE","url":"https://github.com/harfbuzz/harfbuzz/blob/14.6.0/src/hb-wasm-api-list.hh#L85"},{"type":"FIX","url":"https://github.com/harfbuzz/harfbuzz/commit/5e821de8256d01780566b5c8ab7886fae4c93da8"},{"type":"FIX","url":"https://github.com/harfbuzz/harfbuzz/pull/6414"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113679"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/harfbuzz-8.0.0-through-14.6.0-out-of-bounds-write-via-webassembly-font-glyph-to-string"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/harfbuzz/harfbuzz","events":[{"introduced":"b4305532a7746422e0b615eee6304119c1092fd8"},{"last_affected":"c7a7457b7385f33178e8cf87615ca077a810bbe7"},{"fixed":"5e821de8256d01780566b5c8ab7886fae4c93da8"}],"database_specific":{"extracted_events":[{"source":"AFFECTED_FIELD","strategy":"StandardRange","range":[{"introduced":"8.0.0"},{"last_affected":"14.6.0"}]},{"source":"REFERENCES_COMMIT","range":[{"fixed":"5e821de8256d01780566b5c8ab7886fae4c93da8"}]}]}}],"versions":["14.6.0","14.5.1","14.5.0","14.4.0","14.3.1","14.3.0","14.2.1","14.2.0","14.1.0","14.0.0","13.2.1","13.2.0","13.1.1","13.1.0","13.0.1","13.0.0","12.3.2","12.3.1","12.3.0","12.2.0","12.1.0","12.0.0","11.5.1","11.5.0","11.4.5","11.4.4","11.4.3","11.4.2","11.4.1","11.4.0","10.4.0","10.3.0","10.2.0","10.1.0","10.0.1","10.0.0","9.0.0","8.5.0","8.4.0","8.3.1","8.3.0","8.2.2","8.2.1","8.2.0","8.1.1","8.1.0","8.0.1","8.0.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-113679.json","vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://github.com/harfbuzz/harfbuzz/commit/5e821de8256d01780566b5c8ab7886fae4c93da8","target":{"file":"src/hb-wasm-api.h"},"deprecated":false,"digest":{"line_hashes":["333548436696853681483563782986714692698","332269310760523516852965984802967069831","263528804234258733285732189757118251050","129640678444338719177904915694899659002"],"threshold":0.9},"id":"CVE-2026-113679-60b5fabc"},{"id":"CVE-2026-113679-67dc6d39","signature_type":"Line","signature_version":"v1","source":"https://github.com/harfbuzz/harfbuzz/commit/5e821de8256d01780566b5c8ab7886fae4c93da8","target":{"file":"src/hb-wasm-api-font.hh"},"deprecated":false,"digest":{"line_hashes":["33254459101338029056566101499785411793","42574286267419198526633058381188287627","143374696433031058590446044829950468173","308902903835846670442514975783525884844","169496613538168929139209957750765011607","319040883226476558542377660714226692979"],"threshold":0.9}},{"target":{"file":"src/hb-wasm-api-list.hh"},"deprecated":false,"digest":{"line_hashes":["238598749855544507257014300198713833092","191677944125026666787698157232793207187","37620113880327536304517336743889863235","205228394194376080220060859533864381696"],"threshold":0.9},"id":"CVE-2026-113679-7855b7ed","signature_type":"Line","signature_version":"v1","source":"https://github.com/harfbuzz/harfbuzz/commit/5e821de8256d01780566b5c8ab7886fae4c93da8"}],"vanir_signatures_modified":"2026-10-21T09:08:19Z"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}]}