CVE-2026-113680
HarfBuzz 8.0.0 through 14.6.0 WebAssembly Shaper NULL Pointer Dereference DoS
harfbuzz harfbuzz
CVSS
6.8MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.13%Chance of exploitation activity in the next 30 days, higher than 2% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
What fixes it
No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.
Description
HarfBuzz from 8.0.0 through 14.6.0 contains a NULL pointer dereference vulnerability in the experimental WebAssembly shaper host imports buffer_set_contents, face_create, and font_set_coords. Attackers can supply a crafted font whose embedded wasm module passes out-of-range addresses with non-zero lengths, crashing any application that shapes text with the font.
Text from CVE List
Affected versions 1
- harfbuzzaffected: 8.0.0 through 14.6.0CVE List
References 6
- github.com/harfbuzz/harfbuzz/pull/6414Fixvia CVE List
- github.com/harfbuzz/harfbuzz/commit/a71aa86c2bac114fafb6b47f8da02024ecb44fa6Fixvia CVE List
- vulncheck.com/advisories/harfbuzz-8.0.0-through-14.6.0-webassembly-shaper-null-pointer-dereference-dosAdvisoryvia CVE List
- github.com/harfbuzz/harfbuzz/blob/14.6.0/src/hb-wasm-api-buffer.hh#L153-L181Referencevia CVE List
- github.com/harfbuzz/harfbuzz/blob/14.6.0/src/hb-wasm-api-face.hh#L34-L49Referencevia CVE List
- github.com/harfbuzz/harfbuzz/blob/14.6.0/src/hb-wasm-api-font.hh#L241-L258Referencevia CVE List