libschrift CVE-2026-110605

Exploitation requires an application that links or embeds libschrift (<= 0.10.2) and calls sft_render() on attacker-influenced TrueType font data. Two concrete trigger conditions exist: (1) a font whose head table sets unitsPerEm = 0, causing a divide-by-zero; or (2) a font with NaN glyph coordinates that bypass clip_points(), causing an out-of-bounds raster read in draw_line(). Limiting factors: the CVSS vector is AV:L with UI:P (passive), so the malicious font must reach the local rendering context and be rendered by the victim application - there is no privileged access required (PR:N) but there is no self-propagating or fully unauthenticated-remote path; impact is confined to a crash of the rendering process (availability only).

This is a denial-of-service-only vulnerability with a confirmed availability-only impact (CVSS 4.0 6.8, VC:N/VI:N/VA:H; CWE-369 divide-by-zero plus a secondary NaN-driven out-of-bounds raster read). The vendor-supplied CVSS 4.0 vector specifies AV:L and UI:P, meaning exploitation is not remote-automatic: an attacker must get a crafted TrueType font in front of an application that uses libschrift, and a user (or process) must passively render it. There is no integrity or confidentiality impact and no code execution - the realistic worst case is a process crash. No EPSS score, no CISA KEV listing, and no explicit POC flag were provided in the input, so exploitation probability signals are absent rather than low; the VulnCheck advisory and the public hackmd technical write-up/GitHub issue indicate the root cause is well understood and reproducible, but no weaponized exploit is asserted. Net assessment: this is a genuine but low-priority issue - a medium-severity, DoS-only crash in a niche library - not a high-urgency threat. Note a mild signal tension: the library is local-processing (AV:L) yet fonts are frequently delivered over the network to the consuming application, so real-world exposure depends entirely on how the embedding application sources fonts; verify that deployment context before deprioritizing.

An attacker crafts a malicious TrueType font whose head table sets unitsPerEm to 0 (triggering a divide-by-zero) or whose glyph coordinates are NaN (bypassing clip_points() and causing an out-of-bounds read in draw_line()). The attacker delivers this font to an application or service that renders it with libschrift via sft_render(); when the font is processed the process crashes, denying service. The root cause is publicly documented in a VulnCheck advisory and a hackmd write-up, but no packaged exploit code is indicated in the provided data.