CVE-2026-113680 in HarfBuzz
Summary
by MITRE • 10/20/2026
HarfBuzz from 8.0.0 through 14.6.0 contains a NULL pointer dereference vulnerability in the experimental WebAssembly shaper host imports buffer_set_contents, face_create, and font_set_coords. Attackers can supply a crafted font whose embedded wasm module passes out-of-range addresses with non-zero lengths, crashing any application that shapes text with the font.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/20/2026
The HarfBuzz library, a widely used open-source text shaping engine responsible for rendering complex scripts in various operating systems and applications, contains critical memory safety vulnerabilities within its experimental WebAssembly shaper implementation. Specifically affecting versions from 8.0.0 through 14.6.0, these flaws reside in the host imports buffer_set_contents, face_create, and font_set_coords functions. These components are designed to facilitate interaction between HarfBuzz and external WebAssembly modules that handle text shaping logic. The vulnerability arises when an application processes a maliciously crafted font file containing embedded WebAssembly code. In this scenario, the attacker can inject specific parameters into the Wasm module execution context that violate memory safety boundaries, leading directly to a NULL pointer dereference condition.
From a technical perspective, the core issue involves improper validation of input data passed from the host application to the guest WebAssembly environment and vice versa. When an out-of-range address is supplied alongside a non-zero length parameter within these specific API calls, the underlying C code fails to perform adequate bounds checking before attempting memory access operations. This lack of rigorous boundary verification allows the execution flow to attempt dereferencing a null or invalid pointer location in system memory. Because HarfBuzz operates at a low level within the graphics and text rendering pipeline, such an error does not merely result in incorrect visual output but causes immediate termination of the host process due to segmentation faults or access violations.
The operational impact of this vulnerability is significant for any software that relies on HarfBuzz for text layout and rendering. This includes web browsers like Firefox and Chromium-based applications, office suites, document viewers, and mobile operating systems such as Android and iOS which utilize these libraries for UI text display. An attacker can exploit this flaw by distributing a specially crafted font file through email attachments, websites via embedded fonts, or other distribution channels. Upon opening the malicious font in any vulnerable application, the resulting crash disrupts service availability effectively achieving a denial of service against the end user. While current reports emphasize the stability impact rather than arbitrary code execution, memory corruption vulnerabilities often serve as stepping stones for more severe exploits if additional conditions are met within the broader application context.
This vulnerability aligns with CWE-476, which defines NULL Pointer Dereference, indicating a failure to check for null values before using pointers in operations that require valid memory addresses. Furthermore, from an adversary tactics perspective, this flaw supports ATT&CK technique T1499 Endpoint Denial of Service, where attackers leverage software vulnerabilities to disrupt the availability of targeted systems or services without necessarily compromising confidentiality or integrity initially. The use of WebAssembly as a vector for exploitation highlights emerging trends in supply chain and data format attacks where complex binary formats are leveraged to execute untrusted code within sandboxed environments that may still have access to critical host resources if boundary checks fail.
Mitigation strategies primarily involve updating the HarfBuzz library to version 14.6.1 or later, where these specific input validation flaws have been addressed by developers implementing stricter bounds checking and null pointer verification routines before memory operations are executed. Application vendors integrating HarfBuzz should ensure their dependency management systems pull in patched versions of the library across all supported platforms. For users unable to immediately patch, limiting exposure involves avoiding opening font files from untrusted sources or disabling experimental WebAssembly shaper features if such configuration options exist within the specific application environment. Continuous monitoring for new CVEs related to HarfBuzz and maintaining up-to-date security patches remain essential practices given the central role this library plays in modern computing infrastructure text rendering pipelines.