CVE-2026-113679
HarfBuzz 8.0.0 through 14.6.0 Out-of-Bounds Write via WebAssembly font_glyph_to_string
HarfBuzz 8.0.0 through 14.6.0 contains an out-of-bounds write vulnerability in the experimental WebAssembly shaper because the font_glyph_to_string import has a wrong WAMR signature. Attackers can supply a crafted font whose wasm module places the output buffer near linear memory's end, writing glyph-name bytes into host memory to crash or corrupt applications.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Passive
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
HarfBuzz 8.0.0 through 14.6.0 Out-of-Bounds Write via WebAssembly font_glyph_to_string
HarfBuzz 8.0.0 through 14.6.0 contains an out-of-bounds write vulnerability in the experimental WebAssembly shaper because the font_glyph_to_string import has a wrong WAMR signature. Attackers can supply a crafted font whose wasm module places the output buffer near linear memory's end, writing glyph-name bytes into host memory to crash or corrupt applications.
- Record
CVE-2026-113679- CVSS 4.0
- 7.3 High
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 7.0 High
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-787
- Updated
- 2026-11-02
EUVDEUVD-2026-105095
HarfBuzz 8.0.0 through 14.6.0 contains an out-of-bounds write vulnerability in the experimental WebAssembly shaper because the font_glyph_to_string import has a wrong WAMR signature. Attackers can supply a crafted font whose wasm module places the output buffer near linear memory's end, writing glyph-name bytes into host memory to crash or corrupt applications.
- Record
EUVD-2026-105095- CVSS 4.0
- 7.3 High
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-hqgm-v7cx-mq25
HarfBuzz 8.0.0 through 14.6.0 contains an out-of-bounds write vulnerability in the experimental...
HarfBuzz 8.0.0 through 14.6.0 contains an out-of-bounds write vulnerability in the experimental WebAssembly shaper because the font_glyph_to_string import has a wrong WAMR signature. Attackers can supply a crafted font whose wasm module places the output buffer near linear memory's end, writing glyph-name bytes into host memory to crash or corrupt applications.
- Record
GHSA-hqgm-v7cx-mq25- CVSS 4.0
- 7.3 High
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 7.0 High
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-787
- Updated
- 2026-11-02
NVD
HarfBuzz 8.0.0 through 14.6.0 contains an out-of-bounds write vulnerability in the experimental WebAssembly shaper because the font_glyph_to_string import has a wrong WAMR signature. Attackers can supply a crafted font whose wasm module places the output buffer near linear memory's end, writing glyph-name bytes into host memory to crash or corrupt applications.
- Record
CVE-2026-113679- CVSS 4.0
- 7.3 High
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 7.0 High
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-787
- Updated
- 2026-11-02
OSV
HarfBuzz 8.0.0 through 14.6.0 Out-of-Bounds Write via WebAssembly font_glyph_to_string
HarfBuzz 8.0.0 through 14.6.0 contains an out-of-bounds write vulnerability in the experimental WebAssembly shaper because the font_glyph_to_string import has a wrong WAMR signature. Attackers can supply a crafted font whose wasm module places the output buffer near linear memory's end, writing glyph-name bytes into host memory to crash or corrupt applications.
- Record
CVE-2026-113679- CVSS 4.0
- 7.3 High
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - Weakness
- CWE-787
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-113679
HarfBuzz 8.0.0 through 14.6.0 contains an out-of-bounds write vulnerability in the experimental WebAssembly shaper because the font_glyph_to_string import has a wrong WAMR signature. Attackers can supply a crafted font whose wasm module places the output buffer near linear memory's end, writing glyph-name bytes into host memory to crash or corrupt applications.
- Record
DEBIAN-CVE-2026-113679- CVSS 4.0
- 7.3 High
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-113679
HarfBuzz 8.0.0 through 14.6.0 contains an out-of-bounds write vulnerability in the experimental WebAssembly shaper because the font_glyph_to_string import has a wrong WAMR signature. Attackers can supply a crafted font whose wasm module places the output buffer near linear memory's end, writing glyph-name bytes into host memory to crash or corrupt applications.
- Record
UBUNTU-CVE-2026-113679- CVSS 4.0
- 7.3 High
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 7.0 High
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVAZL-109806 No score
CVE-2026-113679 affecting package harfbuzz 8.3.0-4
HarfBuzz 8.0.0 through 14.6.0 contains an out-of-bounds write vulnerability in the experimental WebAssembly shaper because the font_glyph_to_string import has a wrong WAMR signature. Attackers can supply a crafted font whose wasm module places the output buffer near linear memory's end, writing glyph-name bytes into host memory to crash or corrupt applications.
- Record
AZL-109806- Updated
- 2026-11-02
OSVAZL-112814 No score
CVE-2026-113679 affecting package qtbase 6.6.3-7
HarfBuzz 8.0.0 through 14.6.0 contains an out-of-bounds write vulnerability in the experimental WebAssembly shaper because the font_glyph_to_string import has a wrong WAMR signature. Attackers can supply a crafted font whose wasm module places the output buffer near linear memory's end, writing glyph-name bytes into host memory to crash or corrupt applications.
- Record
AZL-112814- Updated
- 2026-11-07
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
harfbuzzAzure Linux:3 |
through 8.3.0-4 | None known |
qtbaseAzure Linux:3 |
through 6.6.3-7 | None known |
harfbuzzDebian:12 |
All versions, plus listed versions 10.0.1-110.1.0-110.1.0-210.2.0-110.2.0-2 Show 19 moreShow less11.4.5-111.5.0-112.1.0-112.2.0-112.3.0-112.3.0-212.3.0-312.3.0-412.3.1-112.3.2-112.3.2-26.0.0+dfsg-38.0.0-18.0.0-28.0.0-38.0.1-18.3.0-18.3.0-29.0.0-1 |
None known |
harfbuzzDebian:13 |
All versions, plus listed versions 10.2.0-110.2.0-1+deb13u110.2.0-211.4.5-111.5.0-1 Show 9 moreShow less12.1.0-112.2.0-112.3.0-112.3.0-212.3.0-312.3.0-412.3.1-112.3.2-112.3.2-2 |
None known |
harfbuzzDebian:14 |
All versions, plus listed versions 10.2.0-110.2.0-211.4.5-111.5.0-112.1.0-1 Show 8 moreShow less12.2.0-112.3.0-112.3.0-212.3.0-312.3.0-412.3.1-112.3.2-112.3.2-2 |
None known |
harfbuzzUbuntu:14.04:LTS |
All versions, plus listed versions 0.9.19-10.9.19-1ubuntu10.9.24-2ubuntu10.9.24-2ubuntu20.9.24-2ubuntu3 Show 6 moreShow less0.9.25-1ubuntu10.9.26-30.9.26-40.9.27-10.9.27-1ubuntu10.9.27-1ubuntu1.1 |
None known |
harfbuzzUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 1.0.1-1build21.0.1-1ubuntu0.11.0.1-1ubuntu0.1+esm1 |
None known |
harfbuzzUbuntu:18.04:LTS |
All versions, plus listed versions 1.4.2-11.4.2-1build11.6.3-1build11.7.1-11.7.2-11.7.2-1ubuntu1 |
None known |
harfbuzzUbuntu:20.04:LTS |
All versions, plus listed versions 2.6.1-32.6.2-12.6.4-12.6.4-1ubuntu12.6.4-1ubuntu2 Show 4 moreShow less2.6.4-1ubuntu32.6.4-1ubuntu42.6.4-1ubuntu4.22.6.4-1ubuntu4.3 |
None known |
harfbuzzUbuntu:22.04:LTS |
All versions, plus listed versions 2.7.4-1ubuntu12.7.4-1ubuntu22.7.4-1ubuntu32.7.4-1ubuntu3.12.7.4-1ubuntu3.2 |
None known |
harfbuzzUbuntu:24.04:LTS |
All versions, plus listed versions 8.0.1-18.0.1-1build18.3.0-28.3.0-2build18.3.0-2build2 |
None known |
harfbuzzUbuntu:26.10 |
All versions, plus listed versions 12.3.2-2 |
None known |
harfbuzzUbuntu:26.04:LTS |
All versions, plus listed versions 10.2.0-112.1.0-112.1.0-1build112.2.0-112.3.0-3 Show 4 moreShow less12.3.0-412.3.1-112.3.2-112.3.2-2 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, facts | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-113679 is a high vulnerability (CVSS 7.3) in Harfbuzz, published October 20, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.17%, the 6th percentile. No source names a fixed version.
References
github.com/harfbuzz/harfbuzz/pull/6414
vulncheck.com/advisories/harfbuzz-8.0.0-through-14.6.0-out-of-bounds-write-via-webassembly-font-glyph-to-string
nvd.nist.gov/vuln/detail/CVE-2026-113679