DEBIAN-CVE-2026-113679

See a problem?
Please try reporting it to the source first.
Source
https://security-tracker.debian.org/tracker/CVE-2026-113679
Import Source
https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-113679.json
JSON Data
https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-113679
Upstream
Published
2026-10-20T16:17:12Z
Modified
2026-10-23T22:00:06Z
Severity
  • 7.3 (High) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X CVSS Calculator
Summary
[none]
Details

HarfBuzz 8.0.0 through 14.6.0 contains an out-of-bounds write vulnerability in the experimental WebAssembly shaper because the font_glyph_to_string import has a wrong WAMR signature. Attackers can supply a crafted font whose wasm module places the output buffer near linear memory's end, writing glyph-name bytes into host memory to crash or corrupt applications.

References

Affected packages

Debian:12 / harfbuzz

Package

Name
harfbuzz
Purl
pkg:deb/debian/harfbuzz?arch=source&distro=bookworm

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

6.*
6.0.0+dfsg-3
8.*
8.0.0-1
8.0.0-2
8.0.0-3
8.0.1-1
8.3.0-1
8.3.0-2
9.*
9.0.0-1
10.*
10.0.1-1
10.1.0-1
10.1.0-2
10.2.0-1
10.2.0-2
11.*
11.4.5-1
11.5.0-1
12.*
12.1.0-1
12.2.0-1
12.3.0-1
12.3.0-2
12.3.0-3
12.3.0-4
12.3.1-1
12.3.2-1
12.3.2-2

Ecosystem specific 

{
    "urgency":  "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-113679.json"

Debian:13 / harfbuzz

Package

Name
harfbuzz
Purl
pkg:deb/debian/harfbuzz?arch=source&distro=trixie

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

10.*
10.2.0-1
10.2.0-1+deb13u1
10.2.0-2
11.*
11.4.5-1
11.5.0-1
12.*
12.1.0-1
12.2.0-1
12.3.0-1
12.3.0-2
12.3.0-3
12.3.0-4
12.3.1-1
12.3.2-1
12.3.2-2

Ecosystem specific 

{
    "urgency":  "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-113679.json"

Debian:14 / harfbuzz

Package

Name
harfbuzz
Purl
pkg:deb/debian/harfbuzz?arch=source&distro=forky

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

10.*
10.2.0-1
10.2.0-2
11.*
11.4.5-1
11.5.0-1
12.*
12.1.0-1
12.2.0-1
12.3.0-1
12.3.0-2
12.3.0-3
12.3.0-4
12.3.1-1
12.3.2-1
12.3.2-2

Ecosystem specific 

{
    "urgency":  "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-113679.json"