EUVD-2026-105096
GHSA-2fqx-2h7j-c7gq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft font embedding malicious wasm module
-
DeliveryDeliver font to wasm-shaper-enabled application
-
ExploitWasm import passes out-of-range address with non-zero length
-
ExecutionTrigger NULL pointer dereference during shaping
-
ImpactCrash text-shaping application (DoS)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Null pointer safety, defensive checks
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the target application to be built with HarfBuzz's EXPERIMENTAL WebAssembly shaper (the HB_WASM host-import path exercising buffer_set_contents, face_create, or font_set_coords) - this feature is not enabled in default builds, which is the dominant limiting factor. A victim must then actively shape text with an attacker-supplied, crafted font whose embedded wasm module passes out-of-range addresses with non-zero lengths (UI:P - passive user interaction opening/rendering the font). Local vector (AV:L) means the malicious font must reach a context where it is processed. Impact is confined to a crash (availability only); there is no code execution, data disclosure, or integrity impact. |
| Impact | This is a genuinely medium-severity, low-priority issue rather than an urgent one, and the signals are internally consistent. The CVSS 4.0 vector (AV:L/AC:L/PR:N/UI:P/VC:N/VI:N/VA:H) scores 6.8 and limits impact to availability only - a crash - with no confidentiality or integrity consequence, which matches CWE-476 (NULL pointer dereference) and the description's statement that the result is 'crashing any application that shapes text.' The attack vector is Local with passive user interaction required: a victim must shape text with an attacker-supplied font. The single most important risk-reducing factor is not captured in the CVSS score at all - the vulnerable code paths (buffer_set_contents, face_create, font_set_coords) live in HarfBuzz's EXPERIMENTAL WebAssembly shaper, which is not compiled or enabled in default builds and is absent from essentially all mainstream downstream deployments (browsers, Android, GNOME). No EPSS score, no CISA KEV listing, and no public exploit were provided in the input, so per the data this is 'no public exploit identified at time of analysis.' Net: a real but low-urgency DoS-only bug whose true exploitable population is far smaller than HarfBuzz's overall footprint would suggest. |
| Exploit ScenarioDerived | An attacker crafts a font file containing an embedded WebAssembly module that calls a host import (e.g. buffer_set_contents or face_create) with an out-of-range memory address and a non-zero length. When a victim application built with HarfBuzz's experimental wasm shaper loads and shapes text using that font, the invalid pointer is dereferenced and the application crashes. No public exploit code or active exploitation is indicated in the provided data; impact is limited to denial of service. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 20, 2026
NULL pointer dereference in HarfBuzz 8.0.0 through 14.6.0 lets a crafted font crash any application that shapes text with it, but only when the library is built with the experimental WebAssembly shaper enabled - a non-default compile-time option. An unauthenticated attacker supplies a malicious font whose embedded wasm module passes out-of-range addresses with non-zero lengths into the buffer_set_contents, face_create, or font_set_coords host imports, and the resulting crash yields availability-only impact (CVSS 3.1 base 6.8, AV:L/AC:L/PR:N/UI:R/A:H). No public exploit code and no confirmed active exploitation were identified at time of analysis, and the dominant risk limiter remains that default HarfBuzz builds never exercise the vulnerable code path.
RemediationAI
Vendor patch status: upstream fix available (PR/commit); a released patched version is not independently confirmed from the provided data. Apply upstream commit a71aa86c2bac114fafb6b47f8da02024ecb44fa6 (PR https://github.com/harfbuzz/harfbuzz/pull/6414), which adds NULL guards to buffer_set_contents, face_create, font_set_coords, font_get_glyph_extents, and font_copy_glyph_outline and corrects the font_glyph_to_string symbol signature; if you consume HarfBuzz from a distribution, track the distro's backport of that commit rather than assuming a version-number threshold. Where patching is delayed, the highest-value control is to rebuild without the experimental WebAssembly shaper (omit the wasm-shaping configure/build option); the trade-off is loss of wasm-based custom shaping, which is acceptable for virtually all deployments since the feature is experimental. Additionally, shape untrusted or user-uploaded fonts inside a sandboxed worker or subprocess with memory/CPU limits so that a NULL dereference terminates only the isolated process rather than the host application - this is a containment measure, not a fix, and adds per-render process overhead. Applications that must support wasm shaper fonts should validate or strip embedded wasm modules from untrusted font files before shaping, at the cost of rejecting legitimate wasm-shaping fonts. No public exploit code was identified at time of analysis, and this CVE is not in CISA KEV, so remediation can be scheduled as routine maintenance rather than emergency response.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
HarfBuzz is the widely embedded OpenType shaping engine used by browsers, PDF renderers, office suites, and Linux desktop stacks. Since 8.0.0 it has shipped an experimental WebAssembly shaper in which a font can carry an embedded wasm module that HarfBuzz executes, calling back into the host through a set of native imports defined in src/hb-wasm-api-*.hh. Those imports translate wasm linear-memory addresses into native pointers via HB_ARRAY_APP2NATIVE / ptr_d, and the vulnerable build omitted validation that the translated pointer was non-NULL before dereferencing it. This is CWE-476 (NULL Pointer Dereference): when a module passes an out-of-range address together with a non-zero length, the translation fails and returns NULL, which is then used unchecked, faulting the host process. The upstream fix (PR 6414 / commit a71aa86c) adds explicit !info / !pos, !blob, !data, !our_coords and !s guards in buffer_set_contents, face_create, font_set_coords, font_get_glyph_extents, and font_copy_glyph_outline; it also corrects an inverted contour-count check in font_copy_glyph_outline and fixes the font_glyph_to_string native symbol signature from "(ii$*)" to "(iiii)". The CPE record cpe:2.3:a:harfbuzz:harfbuzz:* is wildcarded, so any HarfBuzz build should be version-checked rather than assumed unaffected; the vendor advisory scope is explicitly 8.0.0 through 14.6.0.
Know when Harfbuzz gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Crafted font processed locally gives AV:L with UI:R (victim must shape the font); no auth needed so PR:N; impact is a crash only, so C:N/I:N/A:H with S:U.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
HarfBuzz from 8.0.0 through 14.6.0 contains a NULL pointer dereference vulnerability in the experimental WebAssembly shaper host imports buffer_set_contents, face_create, and font_set_coords. Attackers can supply a crafted font whose embedded wasm module passes out-of-range addresses with non-zero lengths, crashing any application that shapes text with the font.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A null pointer dereference occurs when a program attempts to access memory through a pointer that has been set to NULL (address 0x0).
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
An integer overflow in the component hb-ot-shape-fallback.cc of Harfbuzz v4.3.0 allows attackers to cause a Denial of Se
HarfBuzz is a text shaping engine. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, no au
HarfBuzz text shaping engine versions prior to 12.3.0 crash when the SubtableUnicodesCache::create function attempts to
hb-ot-layout-gpos-table.hh in HarfBuzz before 1.0.5 allows remote attackers to cause a denial of service (buffer over-re
Multiple unspecified vulnerabilities in HarfBuzz before 1.0.6, as used in Google Chrome before 48.0.2564.82, allow attac
HarfBuzz::Shaper for Perl versions before 0.032 contain a null pointer dereference in the bundled HarfBuzz library that
hb-ot-layout-gsubgpos.hh in HarfBuzz through 6.0.0 allows attackers to trigger O(n^2) growth via consecutive marks durin
An out-of-bounds write in HarfBuzz 8.0.0 through 14.6.0 allows a crafted font containing an embedded WebAssembly module
Exploit-DB