CVE-2024-56732

What it actually does

Heap-based buffer overflow in hb_cairo_glyphs_from_buffer allows out-of-bounds writes during text shaping of crafted input.

Why it matters to the business

Remote attackers can achieve arbitrary code execution in applications that render text with affected HarfBuzz versions, leading to full system compromise; the affected Ubuntu 14.04 Firefox package remains exposed on long-EOL systems despite a low exploitation probability.

How an attack unfolds

An attacker supplies malicious font or text data to a vulnerable HarfBuzz instance (versions 8.5.0–10.0.1) embedded in Firefox; the hb_cairo_glyphs_from_buffer function performs an unchecked write that corrupts heap memory, enabling control-flow hijacking and payload execution without authentication.

How to fix it

Upgrade Firefox on Ubuntu 14.04 to version 50.0+build2-0ubuntu0.14.04.2 or later; for any HarfBuzz-based product, update to a release containing HarfBuzz 10.0.2 or newer and rebuild against the fixed library.

How to confirm the fix worked

Confirm the installed package version matches or exceeds the listed fixed build; run regression tests that exercise hb_cairo_glyphs_from_buffer with the previously crashing glyph buffers; verify no crash or memory corruption occurs under AddressSanitizer.

Typical attack path

1. Identify a target application using vulnerable HarfBuzz (e.g., Firefox on Ubuntu 14.04)
2. Craft a font file or Unicode string that triggers excessive glyph buffer growth
3. Deliver the payload via web content, document, or network request
4. Trigger text shaping in hb_cairo_glyphs_from_buffer to overflow the heap allocation
5. Overwrite function pointers or metadata to redirect execution to attacker-controlled code

How to detect it

Review web server and browser process logs for unusually large or malformed font requests; inspect crash dumps for heap corruption signatures around glyph buffer handling; correlate with network traffic containing suspicious OpenType or Unicode sequences.

What your security team should do

• Immediately upgrade all instances of the listed Firefox package to the provided fixed version
• Inventory other products that statically or dynamically link HarfBuzz 8.5.0–10.0.1 and schedule upgrades
• Apply network segmentation and application sandboxing around text-rendering workloads until patches are deployed
• Monitor EPSS and KEV status; the current low score does not eliminate the need for prompt remediation on exposed systems