CVE-2026-113679

What it actually does

Out-of-bounds write in the experimental WebAssembly shaper triggered by an incorrect WAMR signature on the font_glyph_to_string import, allowing a crafted font's wasm module to write glyph-name bytes past the end of an output buffer placed near the limit of linear memory.

Why it matters to the business

Applications that render text with affected HarfBuzz versions can crash or have memory corrupted when processing malicious fonts, leading to denial of service, potential data integrity issues, or arbitrary code execution in document viewers, browsers, and publishing tools.

How an attack unfolds

An attacker crafts a font containing a WebAssembly module that exploits the mismatched import signature, positions the glyph-name output buffer at the end of linear memory, and supplies the font to a target application; when the shaper executes the module, the write overflows into adjacent host memory, enabling a crash or corruption.

How to fix it

Upgrade HarfBuzz to a version newer than 14.6.0 that corrects the WAMR signature for font_glyph_to_string; if immediate upgrade is not possible, disable the experimental WebAssembly shaper via build or runtime configuration flags.

How to confirm the fix worked

Confirm the installed HarfBuzz version is newer than 14.6.0, review build configuration to ensure the WebAssembly shaper is disabled or patched, and test rendering of known-malicious test fonts in a controlled environment to verify absence of overflow.

Typical attack path

1. Identify applications using HarfBuzz 8.0.0-14.6.0 with the experimental WebAssembly shaper enabled
2. Generate or obtain a malicious font whose wasm module triggers the incorrect font_glyph_to_string signature
3. Deliver the font via document, web page, or file share to the victim application
4. Trigger text shaping or glyph name resolution on the crafted font
5. Achieve out-of-bounds write resulting in crash or memory corruption

How to detect it

Review application crash logs and memory dumps for HarfBuzz-related segmentation faults or corruption during font loading; inspect process activity for unexpected font file handling and correlate with recent document or web content that triggered text shaping.

What your security team should do

• Prioritize upgrade of HarfBuzz in all products within the next 30 days given the recent publication and memory-corruption class
• Inventory applications and libraries that depend on HarfBuzz and enable the experimental shaper
• Temporarily disable the WebAssembly shaper where feasible until patches are applied
• Monitor EPSS trend and any emerging exploit code for changes in urgency