CVE-2026-113680 harfbuzz CVE debrief

Who should care

Defenders responsible for systems using HarfBuzz for text shaping, especially those handling untrusted fonts, should assess exposure and prioritize patching or mitigation. This includes operators, platform administrators, vulnerability management teams, and security teams that oversee the use of HarfBuzz in their environments.

Why it matters

This vulnerability can cause a denial of service (DoS) in applications using HarfBuzz for text shaping with untrusted fonts. Defenders should prioritize patching or mitigating this vulnerability, especially in applications that use HarfBuzz for text shaping with untrusted fonts. The vulnerability's impact and remediation require verification from official sources.

• Denial of service (DoS) via crafted fonts
• Potential for exploitation requires verification
• Remediation priority for affected systems
• Further vulnerability details require review of official sources

Technical summary

The vulnerability exists in the experimental WebAssembly shaper host imports buffer_set_contents, face_create, and font_set_coords in HarfBuzz versions 8.0.0 through 14.6.0. A crafted font with an embedded WebAssembly module can pass out-of-range addresses with non-zero lengths, causing a NULL pointer dereference and crashing applications that shape text with the font. The vulnerability's impact and remediation require verification from official sources, and defenders should prioritize patching or mitigating this vulnerability, especially in applications that use HarfBuzz for text shaping with untrusted fonts.

Defensive priority

Defenders should prioritize patching or mitigating this vulnerability, especially in applications that use HarfBuzz for text shaping with untrusted fonts.

Recommended defensive actions

• Patch HarfBuzz to version 14.6.1 or later
• Restrict font loading to trusted sources
• Monitor for suspicious font usage
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE Program record and NVD vulnerability detail provide official information about this vulnerability. Additional technical details are available in the source item and supplemental source references.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.