Bug 2556270 (CVE-2026-113679)
| Summary: | CVE-2026-113679 harfbuzz: HarfBuzz: Out-of-bounds write via crafted font in WebAssembly shaper | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security DevOps Team <prodsec-dev> |
| Status: | NEW --- | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | Keywords: | Security |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in HarfBuzz. An attacker can trigger an out-of-bounds write by enticing an application using the experimental WebAssembly (Wasm) shaper to process a specially crafted font. Due to an incorrect function signature in the glyph string conversion interface, the font's embedded WebAssembly module can write data past allocated buffer boundaries into host memory. This can lead to memory corruption, an application crash resulting in a Denial of Service (DoS), or potentially arbitrary code execution.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
OSIDB Bzimport
2026-10-20 15:52:03 UTC
|