Libschrift
Monthly
Crafted TrueType fonts crash applications that embed or link libschrift through 0.10.2, either by setting the head-table unitsPerEm field to 0 or by carrying NaN glyph coordinates that slip past clip_points() and force an out-of-bounds raster read in draw_line() during sft_render(). Exploitation requires no privileges (PR:N) but the malicious font must reach a local rendering context and actually be rendered by the victim application (CVSS 4.0 6.8, AV:L/UI:P; independent assessment: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H), so there is no self-propagating or fully unauthenticated remote path. Impact is availability only: the rendering process terminates, with no code execution, data disclosure, or integrity loss. Public exploit code has not been identified at time of analysis, although a public technical write-up describes the trigger conditions, and the issue is not listed in CISA KEV.
Crafted TrueType fonts crash applications that embed or link libschrift through 0.10.2, either by setting the head-table unitsPerEm field to 0 or by carrying NaN glyph coordinates that slip past clip_points() and force an out-of-bounds raster read in draw_line() during sft_render(). Exploitation requires no privileges (PR:N) but the malicious font must reach a local rendering context and actually be rendered by the victim application (CVSS 4.0 6.8, AV:L/UI:P; independent assessment: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H), so there is no self-propagating or fully unauthenticated remote path. Impact is availability only: the rendering process terminates, with no code execution, data disclosure, or integrity loss. Public exploit code has not been identified at time of analysis, although a public technical write-up describes the trigger conditions, and the issue is not listed in CISA KEV.