Skip to main content

Graphite CVE-2026-50593

| EUVDEUVD-2026-34784 HIGH
Integer Underflow (CWE-191)
2026-06-05 mitre GHSA-3mqg-485v-x9g7
Buffer Overflow Integer Overflow Graphite Graphite Project
7.3
CVSS 3.1 · Vendor: mitre
Share

Severity by source

Vendor (mitre) PRIMARY
7.3 HIGH
AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:H
SUSE
7.1 HIGH
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
Low
Integrity
High
Availability
High

Lifecycle Timeline

3
Patch available
Jun 05, 2026 - 05:00 EUVD
Source Code Evidence Fetched
Jun 05, 2026 - 03:45 vuln.today
Analysis Generated
Jun 05, 2026 - 03:45 vuln.today

DescriptionCVE.org

Graphite before 1.3.15 has an integer underflow and resultant out-of-bounds write via Graphite actions, because slotat does not ensure that an offset is within the allowed slot-map range.

AnalysisAI

Out-of-bounds write in the SIL Graphite smart-font rendering engine before 1.3.15 allows attackers to corrupt memory by supplying a malicious font file that triggers an integer underflow in the slotat macro. Exploitation requires a victim to render attacker-controlled font content in an application that embeds Graphite (such as Firefox, LibreOffice, or Pango-based renderers), and no public exploit has been identified at time of analysis.

Technical ContextAI

Graphite (cpe:2.3:a:graphite_project:graphite) is SIL International's smart-font rendering library used to shape complex scripts; it is embedded in Mozilla Firefox/Thunderbird, LibreOffice, XeTeX, and Pango. The flaw is a CWE-191 (Integer Underflow) in the slotat(x) macro defined in src/inc/opcodes.h, which previously dereferenced map[(x)] without verifying that the resulting pointer fell within the slot-map (smap) bounds. When Graphite bytecode actions pass a negative or oversized offset, pointer arithmetic underflows and the engine writes outside the allocated slot map, producing the out-of-bounds write. The upstream fix at commit ad78c6b adds an explicit bounds check (map + x >= &smap[-1] && map + x < smap.end()) and sets a slot_offset_out_bounds machine status when the check fails.

RemediationAI

Upgrade SIL Graphite to version 1.3.15 or later, which contains the bounds-checked slotat macro from commit ad78c6b7319909e1540c1b134e115ced03417866 (see https://github.com/silnrsi/graphite/compare/1.3.14...1.3.15). Operators of applications that bundle Graphite (Firefox, Thunderbird, LibreOffice, Pango/libgraphite2 packages) should track and apply the corresponding vendor updates as they rebuild against 1.3.15. As a compensating control until patching, disable Graphite font shaping where the host application exposes a toggle - for example, set gfx.font_rendering.graphite.enabled to false in Firefox's about:config, which prevents loading the vulnerable code path at the cost of incorrect rendering for complex scripts (Burmese, N'Ko, SIL test fonts); environments that do not need such scripts can leave this disabled permanently. Additionally, restrict untrusted document and web font sources via Content-Security-Policy font-src directives or by stripping embedded fonts from inbound documents at the gateway, accepting reduced fidelity for legitimate content that relies on custom fonts.

More in Graphite

View all
CVE-2013-5093 MEDIUM POC
6.8 Sep 27

The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python

CVE-2022-4730 MEDIUM POC
5.4 Dec 27

A vulnerability was found in Graphite Web. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable,
CVE-2022-4729 MEDIUM POC
5.4 Dec 27

A vulnerability was found in Graphite Web and classified as problematic. Rated medium severity (CVSS 5.4), this vulnerab
CVE-2022-4728 MEDIUM POC
5.4 Dec 27

A vulnerability has been found in Graphite Web and classified as problematic. Rated medium severity (CVSS 5.4), this vul
CVE-2024-13051 HIGH
7.8 Dec 30

Ashlar-Vellum Graphite VC6 File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. Rated high sever
CVE-2024-13050 HIGH
7.8 Dec 30

Ashlar-Vellum Graphite VC6 File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. Rated high sever
CVE-2023-39936 HIGH
7.8 Oct 26

In Ashlar-Vellum Graphite v13.0.48, the affected application lacks proper validation of user-supplied data when parsing

CVE-2023-39427 HIGH
7.8 Oct 26

In Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, and Cobalt Share v12 SP0 Build (1204.77), the affected applications lack
CVE-2013-5942 MEDIUM
6.8 Sep 27

Graphite 0.9.5 through 0.9.10 uses the pickle Python module unsafely, which allows remote attackers to execute arbitrary
CVE-2013-5943 MEDIUM
4.3 Sep 27

Multiple cross-site scripting (XSS) vulnerabilities in Graphite before 0.9.11 allow remote attackers to inject arbitrary
CVE-2025-7988 HIGH
7.8 Sep 17

Ashlar-Vellum Graphite VC6 File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. Rated high severity (CV
CVE-2025-7987 HIGH
7.8 Sep 17

Ashlar-Vellum Graphite VC6 File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. Rated high severity (CV

Same weakness CWE-191 – Integer Underflow

View all
CVE-2014-0497 CRITICAL POC
9.8
CVE-2015-5212 MEDIUM
6.8
CVE-2017-14496 HIGH POC
7.5
CVE-2014-8768 MEDIUM POC
5.0
CVE-2017-11757 CRITICAL POC
9.8
CVE-2024-23313 CRITICAL POC
9.8
CVE-2021-3323 CRITICAL POC
9.8
CVE-2021-21811 CRITICAL POC
9.8

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
Container suse/sl-micro/6.0/base-os-container:latest Container suse/sl-micro/6.0/toolbox:latest Image SLE-Micro Image SLE-Micro-Azure Image SLE-Micro-BYOS Image SLE-Micro-BYOS-Azure Image SLE-Micro-BYOS-EC2 Image SLE-Micro-BYOS-GCE Image SLE-Micro-EC2 Image SLE-Micro-GCE Affected
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS Affected
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS Affected

Share

CVE-2026-50593 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy