{"id":"CVE-2026-63660","published":"2026-11-11T03:16:52.367","lastModified":"2026-11-11T03:16:52.367","description":"node-fontnik is a library that delivers a range of glyphs rendered as SDFs (signed distance fields) in a protocol buffer. Prior to version 0.7.7, a crafted font could trigger a heap out-of-bounds write in RenderSDF (include/mapbox/glyph_foundry_impl.hpp). RenderSDF computed the SDF bitmap allocation size as buffered_width * buffered_height in 32-bit unsigned int. Glyph dimensions are derived from the uploaded font's outline bounding box with no upper bound, so a glyph large enough to make that product exceed 2³² wrapped to a small value. The buffer was then under-allocated while the render loop still wrote one byte per pixel, corrupting the heap (CWE-190 → CWE-787) and crashing the process. A 680-byte font is enough to drive FreeType to a 65536×65536 buffered glyph, wrapping the size to 0. This issue has been patched in version 0.7.7.","cvssScore":8.1,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","cwes":["CWE-190","CWE-787"],"vendors":[],"products":[],"references":[{"url":"https://github.com/mapbox/node-fontnik/pull/202","tags":[]},{"url":"https://github.com/mapbox/node-fontnik/releases/tag/v0.7.7","tags":[]},{"url":"https://github.com/mapbox/node-fontnik/security/advisories/GHSA-cfm6-c7rv-58xj","tags":[]}],"exploitRefs":[{"url":"https://github.com/mapbox/node-fontnik/pull/202","tags":[]},{"url":"https://github.com/mapbox/node-fontnik/releases/tag/v0.7.7","tags":[]},{"url":"https://github.com/mapbox/node-fontnik/security/advisories/GHSA-cfm6-c7rv-58xj","tags":[]}],"hasPoc":true,"ai":null}