CVE-2026-50593

What it actually does

Graphite versions before 1.3.15 contain an integer underflow in Graphite action handling. The slotat logic does not sufficiently validate that a calculated offset remains inside the permitted slot-map range, which can lead to an out-of-bounds write. In applications that use Graphite for complex font shaping, a maliciously crafted font or document containing Graphite layout data can corrupt process memory. Depending on the embedding application, this can cause crashes, data corruption, or potentially arbitrary code execution within the privileges of the application processing the content.

Why it matters to the business

Organizations using applications or platforms that embed vulnerable Graphite font-rendering code may be exposed through routine handling of documents, fonts, or rendered content. Successful exploitation could disrupt user applications, compromise document-processing workflows, or allow an attacker to gain code execution in a user context. The public exploitation signal is currently low, with low EPSS and no known KEV listing, but the vulnerability affects a parsing/rendering component that is commonly distributed through downstream operating system and application packages, so exposure may exist indirectly even where Graphite is not deployed as a standalone product.

How an attack unfolds

An attacker prepares a malicious font, document, or other content that causes an application to invoke vulnerable Graphite action processing. When the victim opens or previews the content in an application linked against Graphite before 1.3.15, the crafted Graphite instructions trigger an integer underflow in slot offset calculation. Because the offset is not properly constrained to the valid slot-map range, Graphite performs an out-of-bounds write. In the simplest case this crashes the rendering application; with additional heap-layout control and exploit engineering, the memory corruption may be used to alter program state or execute attacker-controlled code in the context of the user-running application. Exploitation requires user interaction or processing by a local application and there is no current indication of active exploitation.

How to fix it

Upgrade Graphite/Graphite2 to version 1.3.15 or later. Where Graphite is provided by the operating system or application vendor, apply the vendor security update rather than manually replacing library files. Prioritize endpoints and servers that process untrusted fonts, documents, email attachments, PDFs, web content, or uploaded files. If immediate patching is not possible, reduce exposure by blocking untrusted font installation, disabling preview of untrusted documents where feasible, restricting automated document conversion pipelines, and isolating high-risk rendering workloads in sandboxes or containers.

How to confirm the fix worked

Confirm installed Graphite or Graphite2 package versions are 1.3.15 or later, including copies bundled inside applications. On Linux and Unix-like systems, check distribution package metadata and linked library versions for libgraphite2. For desktop applications, verify vendor advisories and application builds that include the fixed library. Where feasible, run controlled regression tests using vendor or project test cases to ensure crafted Graphite input no longer crashes the consuming application. Also validate that document previewers, converters, browser components, and office suites have been restarted or redeployed after patching so they are no longer using the vulnerable library in memory.

Typical attack path

1. Identify target applications or services that use Graphite or a vulnerable downstream package for font shaping or document rendering.
2. Create a malicious font or document containing crafted Graphite actions that trigger the slot offset underflow.
3. Deliver the file through email, download, shared storage, chat, or another content-delivery path.
4. Entice a user to open, preview, or otherwise process the crafted content with a vulnerable application.
5. Trigger out-of-bounds memory corruption during Graphite action processing.
6. Cause application denial of service or attempt to gain code execution within the affected process.

How to detect it

To determine whether exploitation may already have occurred, review endpoint, application, and crash telemetry for abnormal failures in software that renders fonts or documents and links against Graphite/libgraphite2. Focus on crashes occurring immediately after opening external documents, email attachments, downloaded files, font files, or uploaded content. Relevant sources include endpoint detection telemetry, application crash reports, system journals, Windows Error Reporting, macOS crash logs, Linux core dumps, email gateway logs, web proxy/download logs, file server access logs, and document-processing service logs. Investigate crash stacks or core dumps referencing Graphite action processing, slot handling, or libgraphite2. Because exploitation is memory-corruption based, durable indicators may be limited; absence of file artifacts does not rule out exploitation. Correlate suspicious crashes with recently received or accessed font/document files and preserve the triggering files for reverse engineering in an isolated environment.

• libgraphite2
• graphite2
• slotat
• Graphite actions
• out-of-bounds write
• integer underflow
• core dumped
• segmentation fault
• SIGSEGV
• Windows Error Reporting
• libgraphite2.so
• libgraphite2.dll
• libgraphite2.dylib

What your security team should do

• Inventory systems and applications that include Graphite/Graphite2, especially document viewers, office suites, browsers, PDF tools, and automated file-processing services.
• Patch or upgrade Graphite/Graphite2 to 1.3.15 or later through trusted vendor channels.
• Prioritize systems that process files from email, web uploads, customer submissions, or other untrusted sources.
• Review recent crashes in applications linked to Graphite/libgraphite2, particularly after opening fonts or documents from external sources.
• Ensure endpoint protections and email/web gateways treat unexpected font files and document attachments as higher-risk content.
• Use sandboxing or workload isolation for automated rendering, document conversion, and preview generation services.
• Monitor vendor advisories for downstream packages because many applications may inherit the vulnerable library indirectly.