CVE-2026-113679 HarfBuzz 8.0.0 through 14.6.0 Out-of-Bounds Write via WebAssembly font_glyph_to_string

High 7.3 Published 20 Oct 2026 Updated 20 Oct 2026

Exploited in the wild: Not known
Fix: None listed

What is CVE-2026-113679?

CVE-2026-113679 is a high-severity vulnerability in harfbuzz, published on 20 Oct 2026.

Official description

HarfBuzz 8.0.0 through 14.6.0 contains an out-of-bounds write vulnerability in the experimental WebAssembly shaper because the font_glyph_to_string import has a wrong WAMR signature. Attackers can supply a crafted font whose wasm module places the output buffer near linear memory's end, writing glyph-name bytes into host memory to crash or corrupt applications.

Weakness: CWE-787

Which versions are affected by CVE-2026-113679?

How do I fix CVE-2026-113679?

No fix has been published for CVE-2026-113679 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-113679 being exploited?

There is no known exploitation of CVE-2026-113679 in the wild and no public exploit code.

Sources

Also known as AZL-109806, DEBIAN-CVE-2026-113679, ECHO-26d8-255c-66e8, GHSA-hqgm-v7cx-mq25, UBUNTU-CVE-2026-113679.