CVE-2026-113679 in HarfBuzz
Summary
by MITRE • 10/20/2026
HarfBuzz 8.0.0 through 14.6.0 contains an out-of-bounds write vulnerability in the experimental WebAssembly shaper because the font_glyph_to_string import has a wrong WAMR signature. Attackers can supply a crafted font whose wasm module places the output buffer near linear memory's end, writing glyph-name bytes into host memory to crash or corrupt applications.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/20/2026
The vulnerability identified in HarfBuzz versions 8.0.0 through 14.6.0 represents a critical security flaw within its experimental WebAssembly shaper component. This issue stems from an incorrect signature definition for the font_glyph_to_string import function when interfacing with the WAMR runtime environment. In secure software architecture, strict adherence to interface contracts is paramount, particularly when dealing with memory management across different execution contexts such as host and guest environments. The misalignment in the WebAssembly Module Runtime signature means that the parameters passed between the HarfBuzz engine and the underlying WebAssembly module are not validated or handled according to expected bounds, creating a fundamental disconnect in how data buffers are managed during glyph processing operations.
From a technical perspective, this flaw manifests as an out-of-bounds write vulnerability. When a user supplies a specially crafted font file, the associated WebAssembly module can manipulate memory addresses within its linear memory space. By positioning the output buffer for glyph names near the very end of the allocated linear memory, the application is tricked into writing data beyond the intended boundaries. Because WebAssembly modules typically share linear memory with their host environment or have specific boundary checks that are bypassed due to this signature error, these writes can spill over into adjacent host memory regions. This behavior allows an attacker to overwrite arbitrary memory locations outside the sandboxed environment of the WebAssembly module, leading to potential application crashes or, more severely, remote code execution if the overwritten data includes control flow pointers or function addresses.
The operational impact of this vulnerability is significant for any system relying on HarfBuzz for text shaping within a WebAssembly context. Attackers can exploit this flaw by distributing malicious font files that trigger the out-of-bounds write condition upon rendering. The immediate consequence is often a denial of service, as the corruption of host memory typically causes the application to terminate unexpectedly. However, in more complex scenarios involving heap exploitation techniques, an attacker could potentially achieve arbitrary code execution on the victim's machine. This risk is particularly acute for web-based applications or desktop software that integrate HarfBuzz via WebAssembly, as these environments are increasingly common for high-performance text rendering tasks.
To mitigate this vulnerability, it is essential to update HarfBuzz to a version where the font_glyph_to_string import signature has been corrected and validated against WAMR standards. Developers should ensure they are not using experimental features in production environments until such components have undergone rigorous security auditing. Additionally, implementing strict input validation for font files can help prevent malformed data from reaching the vulnerable code paths. Security teams should also consider deploying runtime protection mechanisms that monitor memory access patterns within WebAssembly modules to detect and block out-of-bounds writes before they cause systemic damage.
This vulnerability aligns with Common Weakness Enumeration category CWE-787, which covers out-of-bounds write conditions resulting from improper validation of buffer boundaries. Furthermore, the exploitation technique relates to ATT&CK tactic T1059, specifically Command and Scripting Interpreter subcategories where attackers leverage system utilities or interpreters like WebAssembly modules to execute malicious code. The lack of proper boundary checks in inter-process communication between host and guest environments highlights a broader class of risks associated with sandboxed execution models that rely on complex interface definitions. Addressing these issues requires not only patching the specific function but also reinforcing the overall security posture around external module integration and memory management protocols within text processing libraries.