Read the docs

harfbuzz

Records2All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high1CVSS 7.0–8.9

Exploited now

harfbuzz records in CISA KEV

No harfbuzz vulnerabilities are listed in CISA KEV.

Records

2 records

TI-2026-76946 CVE-2026-113679 · GHSA-hqgm-v7cx-mq25

Out-of-bounds write in HarfBuzz WebAssembly font shaper

Priority LOW 33

HarfBuzz 8.0.0 through 14.6.0 contains an out-of-bounds write vulnerability in the experimental WebAssembly shaper because the font_glyph_to_string import has a wrong WAMR signature.

CVSS 4.0HIGH 7.3 Local No auth User interaction EPSS 0.00169 Published 2026-10-20 No fix listed CWE-787
TI-2026-76947 CVE-2026-113680 · GHSA-2fqx-2h7j-c7gq

NULL pointer dereference in HarfBuzz WebAssembly shaper crashes apps

Priority LOW 29

HarfBuzz from 8.0.0 through 14.6.0 contains a NULL pointer dereference vulnerability in the experimental WebAssembly shaper host imports buffer_set_contents, face_create, and font_set_coords.

CVSS 4.0MEDIUM 6.8 Local No auth User interaction EPSS 0.00168 Published 2026-10-20 No fix listed CWE-476
Open these records in search →