CVE-2026-113679: Out-of-Bounds Write in HarfBuzz’s Experimental WebAssembly Shaper via font_glyph_to_string WAMR Signature Mismatch

Summary

CVE-2026-113679 is an out-of-bounds write vulnerability (CWE-787) in HarfBuzz 8.0.0 through 14.6.0, located in the library’s experimental WebAssembly shaper. The font_glyph_to_string import is declared with a wrong WAMR signature, which allows a crafted font — one whose embedded wasm module deliberately places an output buffer near the end of linear memory — to have glyph-name bytes written past the buffer into host memory. The stated outcome is a crash or corruption of the host application. The vulnerability carries a CVSS 3.1 base score of 7.0 (HIGH) with the vector CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H.

Technical Analysis

HarfBuzz is a text shaping library, and the references for this advisory point directly into its WebAssembly API surface — specifically src/hb-wasm-api-font.hh and src/hb-wasm-api-list.hh at the 14.6.0 tag. The description identifies the affected component as the experimental WebAssembly shaper, a mode in which shaping-related logic can run as a WebAssembly module inside the shaping process rather than as native library code.

In a WebAssembly embedding, the host exposes native functions to guest modules through imports. Each import has a signature — the set of parameter and return types the runtime uses to marshal values between the sandboxed guest and the host. The description states that the font_glyph_to_string import is registered with a wrong WAMR signature. WAMR refers to the WebAssembly Micro Runtime, the engine named in the description. When an import’s declared signature does not match what the host function actually expects, arguments and return values can be marshaled with the wrong types or sizes, and memory boundaries the host believes it is enforcing can be violated. The exact nature of the mismatch — which parameter or return type differs, and by how much — is not fully disclosed in the provided description.

The exploitation path described is precise about the memory-layout trick. An attacker supplies a crafted font containing a wasm module. That module arranges its output buffer — the region where glyph names are written — near the end of linear memory. When shaping invokes font_glyph_to_string, glyph-name bytes are written beyond the buffer’s end, into host memory. Because the font is attacker-crafted, the glyph names being serialized originate from the attacker’s file. The description states the result is a crash or corruption of applications; it does not claim code execution, and no such claim should be inferred from the provided data.

The detail that the output buffer sits near the end of linear memory is what turns a signature bug into a cross-boundary write. In WebAssembly, linear memory is the guest’s contiguous address space; the description states that the crafted module positions the buffer near its end, so the glyph-name bytes written by the faulty import run past the buffer and into host memory. How far the write can reach, how many bytes are written, and which host structures can be overwritten are details not fully disclosed.

The weakness is classified as CWE-787, out-of-bounds write: data is written outside the intended bounds of a buffer. That classification matches the described behavior — a write that starts in a guest-designated buffer and continues past its boundary into memory the host did not intend to expose.

The CVSS 3.1 vector, CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H, breaks down as follows:

AV:L (Local) — the attack vector is local: the crafted font must be processed on the target system; the vulnerability itself is not reachable over a network path.
AC:H (High attack complexity) — successful exploitation depends on conditions beyond the attacker’s easy control, consistent with a bug that requires the output buffer to sit near linear memory’s end and the signature mismatch to line up.
PR:N (No privileges required) — the attacker needs no privileges on the target system.
UI:R (User interaction required) — a user must perform an action, such as opening or rendering content that triggers shaping of the crafted font.
S:U (Scope unchanged) — the described impact remains within the security scope of the vulnerable component.
C:H/I:H/A:H — high ratings for confidentiality, integrity, and availability impact, reflecting the severity ceiling typical of out-of-bounds writes even though the description’s stated outcomes are crash or corruption.

It is worth emphasizing the honesty boundary: the provided description supports crash and memory corruption as the stated outcomes. The high confidentiality and integrity scores describe the potential ceiling of an out-of-bounds write into host memory, but the data provided does not include a demonstrated information-leak or code-execution result, so this article does not assert one.

Affected Software and Versions

The vulnerability affects HarfBuzz versions 8.0.0 through 14.6.0, inclusive. The NVD record’s vendor and product fields are not populated in the data available for this article; however, the references identify the project unambiguously as HarfBuzz, hosted in the harfbuzz/harfbuzz GitHub repository.

The affected component is the experimental WebAssembly shaper. The advisory references cite two source locations at version 14.6.0 as relevant to the font_glyph_to_string import:

src/hb-wasm-api-font.hh, lines 115–123 — the font-related WASM API file cited for this vulnerability.
src/hb-wasm-api-list.hh, line 85 — the WASM API list file cited for this vulnerability.

The experimental status of the shaper matters for exposure assessment. Because the component is labeled experimental in the description, it is reasonable to expect that not every HarfBuzz consumer builds or enables it; exposure therefore varies by build configuration, and the version range alone (8.0.0–14.6.0) is a necessary but not sufficient condition for a vulnerable deployment. The provided data does not quantify how widely the WASM shaper is enabled in downstream packages.

Regarding the fix, the references include pull request #6414 and commit 5e821de8256d01780566b5c8ab7886fae4c93da8 in the upstream repository — the remediation artifacts associated with this advisory. The provided data does not state the first fixed release version, so that detail is not fully disclosed; verify current fixed versions against the upstream repository before declaring a deployment remediated.

Impact

The direct impact, as stated in the description, is that glyph-name bytes are written into host memory, which can crash or corrupt applications that shape the crafted font. An out-of-bounds write under CWE-787 is a memory-corruption primitive: the attacker influences where the write lands, by positioning the output buffer near linear memory’s end, and the bytes being written come from the crafted font’s glyph names.

The CVSS impact metrics are high across the triad — confidentiality (C:H), integrity (I:H), and availability (A:H) — within an unchanged scope (S:U). In practical terms, the availability impact is the most directly supported by the description, since crashes are an explicitly stated outcome; memory corruption speaks to integrity. The high confidentiality score reflects the potential of host-memory writes, but the provided data does not describe a demonstrated information leak.

Two contextual points matter for triage:

The vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog (KEV: false in the provided data).
The provided data contains no evidence of in-the-wild exploitation or public exploit code; the references are advisory, source-code, and remediation links.

Exploitation Scenario

The following scenario is illustrative and is derived directly from the vulnerability description and CVSS vector. It is not a documented attack observed in the wild.

An attacker prepares a font file that embeds a WebAssembly module intended for HarfBuzz’s experimental WASM shaper.
The wasm module is written so that the buffer it designates for glyph-name output sits near the end of linear memory.
The attacker delivers the font to a target — for example, as a document attachment or embedded resource — and a local user interacts with it, causing the host application to shape text using the crafted font. The UI:R metric in the CVSS vector reflects this required user action.
During shaping, the module calls the font_glyph_to_string import. Because the import carries a wrong WAMR signature, the call does not enforce the boundary the host intends.
Glyph-name bytes from the crafted font are written past the output buffer, across the end of linear memory, into host memory.
The host application crashes, or its memory is corrupted — the two outcomes the description states.

The local attack vector (AV:L) and the absence of required privileges (PR:N) mean the scenario is user-assisted rather than network-propagated: the attacker needs the target to process the file, not network access to a vulnerable service.

Detection and Mitigation

Detection

Detection combines version inventory with component-level checks:

Version inventory: identify deployments linking HarfBuzz and check whether the version falls in the 8.0.0–14.6.0 range.
Component check: the flaw is specific to the experimental WebAssembly shaper. Determine whether your build compiles and enables that shaper; the provided data does not disclose the exact build-time or runtime flags, so consult the upstream repository for how the WASM shaper is gated in your version.
Code-level indicators: the advisory references point to src/hb-wasm-api-font.hh (lines 115–123) and src/hb-wasm-api-list.hh (line 85) at the 14.6.0 tag as the code locations relevant to the font_glyph_to_string import. Comparing your checkout of these files against the referenced fix commit can confirm exposure.
Tracking identifiers: the GitHub advisory ID for this issue is GHSA-hqgm-v7cx-mq25, which many dependency-scanning tools consume.

Mitigation

Mitigation follows from the root cause and the affected range:

Update HarfBuzz to a version that includes the fix referenced by pull request #6414 and commit 5e821de8256d01780566b5c8ab7886fae4c93da8. Because the data does not name the first fixed release, confirm the fixed version with upstream before declaring remediation complete.
Disable the experimental WASM shaper where it is not required. The description scopes the vulnerability to that component and to fonts whose wasm modules trigger the faulty import; not loading attacker-supplied wasm shaper modules removes the described path. This is a risk-reduction measure derived from the described attack surface, not a formally documented vendor workaround.
Treat fonts as untrusted input. The attack requires user interaction with a crafted font (UI:R), so applications and workflows that render untrusted documents should not shape fonts from untrusted sources with a vulnerable HarfBuzz build.

Bug Bounty Angle

For bug bounty hunters, CVE-2026-113679 defines a concrete crafted-file attack surface: a font whose embedded wasm module manipulates memory layout to escape a buffer during shaping. Several angles follow from the data:

Unpatched embedders. HarfBuzz is consumed by many applications. Any target in an authorized program that bundles HarfBuzz 8.0.0–14.6.0 with the experimental WASM shaper enabled is potentially exposed. Version strings, vendored copies, or build metadata in the target can reveal this.
Crash reproduction on vulnerable builds. Within program scope, a test font whose wasm module places its glyph-name output buffer near linear memory’s end and exercises font_glyph_to_string matches the described trigger. The expected observations are crashes or memory corruption — exactly the outcomes the description states.
Known-vulnerability caution. This issue is published across NVD, a VulnCheck advisory, and GitHub advisory GHSA-hqgm-v7cx-mq25, with an upstream fix referenced. Most programs will classify reports of the CVE itself as known. The value lies in demonstrating that a specific target ships the vulnerable version in an exploitable configuration, or in finding adjacent signature-mismatch issues in the same WASM import surface — a root-cause class the description makes concrete.
Report quality. Given the AV:L/UI:R scoring, a strong report shows the full chain: the crafted font, the user action that triggers shaping, the version and shaper configuration of the target, and crash artifacts such as stack traces or sanitizer output demonstrating the out-of-bounds write.

Frequently Asked Questions

What is CVE-2026-113679?

An out-of-bounds write (CWE-787) in HarfBuzz 8.0.0 through 14.6.0’s experimental WebAssembly shaper. The font_glyph_to_string import has a wrong WAMR signature, so crafted fonts can write glyph-name bytes past a buffer into host memory, crashing or corrupting applications. CVSS 3.1: 7.0 HIGH.

Which HarfBuzz versions are affected?

Versions 8.0.0 through 14.6.0, inclusive. Only the experimental WebAssembly shaper is implicated. The data does not name the first fixed release, but references remediation pull request #6414 and commit 5e821de8256d01780566b5c8ab7886fae4c93da8 upstream.

How is CVE-2026-113679 exploited?

An attacker supplies a crafted font whose wasm module places the glyph-name output buffer near the end of linear memory. When font_glyph_to_string runs, glyph-name bytes are written into host memory, causing crashes or corruption. The attack is local (AV:L) and requires user interaction (UI:R).

Who discovered CVE-2026-113679, and is it exploited in the wild?

It was discovered by Aziz Elbelaychy of Ostorlab, with the CVE assigned by VulnCheck. The provided data marks KEV as false — it is not in CISA’s Known Exploited Vulnerabilities catalog — and contains no evidence of in-the-wild exploitation.

Discovery and Credits: Discovered by Aziz Elbelaychy (Ostorlab). CVE assigned by VulnCheck.