CVE-2026-110605 tomolt CVE debrief

Who should care

Defenders responsible for applications using libschrift, especially those handling font rendering, should assess exposure and prioritize verification and updates. This includes operators, platform administrators, vulnerability management teams, and security teams who need to review and mitigate the vulnerability to prevent application crashes.

Why it matters

Defenders should prioritize verifying and updating libschrift to prevent application crashes due to the divide by zero vulnerability, especially in applications handling font rendering.

• Potential application crashes due to divide by zero vulnerability.
• Need for verification and updates to libschrift to prevent crashes.
• Possible impact on font rendering in applications using libschrift.

Technical summary

libschrift through 0.10.2 contains a divide by zero vulnerability that allows attackers to crash applications by supplying a font with unitsPerEm of 0 in the head table. Attackers can provide a crafted TrueType font whose NaN glyph coordinates bypass clip_points(), causing an out-of-bounds raster read in draw_line() during sft_render() and crashing the process. The vulnerability can be triggered in applications handling font rendering, and defenders should prioritize verifying and updating libschrift to prevent application crashes.

Defensive priority

Defenders should prioritize verifying and updating libschrift to a version beyond 0.10.2 if possible, and assess exposure in applications using this library, especially those handling font rendering.

Recommended defensive actions

• Verify and update libschrift to a version beyond 0.10.2 if possible.
• Assess exposure in applications using libschrift, especially those handling font rendering.
• Monitor for and handle potential crashes or issues related to font rendering in applications.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and source item provide details on the divide by zero vulnerability in libschrift through 0.10.2, which can cause applications to crash. Evidence is limited to the information provided in the CVE record and source item. Defenders should verify the vulnerability and assess exposure in applications using libschrift, especially those handling font rendering. The vulnerability allows attackers to crash applications by supplying a font with unitsPerEm of 0 in the head table.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.