CVE-2026-110605: falha de média gravidade em tomolt libschrift
libschrift through 0.10.2 Divide by Zero via unitsPerEm in draw_line
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.8epss 0.3%
libschrift through 0.10.2 contains a divide by zero vulnerability that allows attackers to crash applications by supplying a font with unitsPerEm of 0 in the head table. Attackers can provide a crafted TrueType font whose NaN glyph coordinates bypass clip_points(), causing an out-of-bounds raster read in draw_line() during sft_render() and crashing the process.
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Produtos afetados
tomolt · libschriftReferências
https://github.com/tomolt/libschrift/blob/v0.10.2/schrift.c#L1422-L1503https://github.com/tomolt/libschrift/blob/v0.10.2/schrift.c#L542https://github.com/tomolt/libschrift/issues/46https://hackmd.io/@haind-pwn/libschrift-unitsperem-zero-oobhttps://www.vulncheck.com/advisories/libschrift-through-0.10.2-divide-by-zero-via-unitsperem-in-draw-line