CVE-2026-113680 HarfBuzz 8.0.0 through 14.6.0 WebAssembly Shaper NULL Pointer Dereference DoS

Medium 6.8 Published 20 Oct 2026 Updated 21 Oct 2026

Exploited in the wild: Not known
Fix: None listed

What is CVE-2026-113680?

CVE-2026-113680 is a medium-severity vulnerability in harfbuzz, published on 20 Oct 2026.

Official description

HarfBuzz from 8.0.0 through 14.6.0 contains a NULL pointer dereference vulnerability in the experimental WebAssembly shaper host imports buffer_set_contents, face_create, and font_set_coords. Attackers can supply a crafted font whose embedded wasm module passes out-of-range addresses with non-zero lengths, crashing any application that shapes text with the font.

Weakness: CWE-476

Which versions are affected by CVE-2026-113680?

How do I fix CVE-2026-113680?

No fix has been published for CVE-2026-113680 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-113680 being exploited?

There is no known exploitation of CVE-2026-113680 in the wild and no public exploit code.

Sources

Also known as AZL-109809, DEBIAN-CVE-2026-113680, ECHO-a5d1-e1b2-a5a5, GHSA-2fqx-2h7j-c7gq, UBUNTU-CVE-2026-113680.