CVE-2026-113680

What it actually does

NULL pointer dereference in HarfBuzz WebAssembly shaper host imports (buffer_set_contents, face_create, font_set_coords) when an embedded wasm module supplies out-of-range addresses with non-zero lengths, resulting in application crash during text shaping.

Why it matters to the business

Applications that render text using HarfBuzz become unreliable when processing untrusted fonts, causing unexpected crashes and denial of service for end users or services; the issue affects a widely used library with growing EPSS trend six days after disclosure.

How an attack unfolds

An attacker creates a font file containing a malicious WebAssembly module that passes invalid memory addresses to the vulnerable host imports; the victim application loads and shapes text with the font, triggering the NULL dereference and crash.

How to fix it

Upgrade HarfBuzz to a version newer than 14.6.0 that contains fixes for the WebAssembly shaper host imports once released; in the interim disable experimental WebAssembly shaper support if the build option exists.

How to confirm the fix worked

Confirm HarfBuzz version is outside 8.0.0-14.6.0 range; attempt text shaping with a test font that exercises the three vulnerable host imports and verify absence of crash.

Typical attack path

1. Craft a font embedding a wasm module that supplies out-of-range addresses to buffer_set_contents, face_create or font_set_coords
2. Deliver the malicious font via document, web page or application resource
3. Victim application processes the font during text layout or shaping
4. HarfBuzz dereferences NULL and the process terminates

How to detect it

Monitor application crash logs and core dumps for HarfBuzz symbols related to the wasm shaper; correlate with file-open events involving font resources; no public exploitation artifacts are known at this time.

What your security team should do

• Track HarfBuzz release announcements and schedule upgrade within standard patch windows given low EPSS and absence from KEV
• Inventory internal and third-party applications that link HarfBuzz and prioritize those handling untrusted fonts
• Test disabling experimental wasm shaper in build configurations as a temporary control