CVE-2026-63660

Sin historial EPSS suficiente todavía.

node-fontnik is a library that delivers a range of glyphs rendered as SDFs (signed distance fields) in a protocol buffer. Prior to version 0.7.7, a crafted font could trigger a heap out-of-bounds write in RenderSDF (include/mapbox/glyph_foundry_impl.hpp). RenderSDF computed the SDF bitmap allocation size as buffered_width * buffered_height in 32-bit unsigned int. Glyph dimensions are derived from the uploaded font's outline bounding box with no upper bound, so a glyph large enough to make that product exceed 2³² wrapped to a small value. The buffer was then under-allocated while the render loop still wrote one byte per pixel, corrupting the heap (CWE-190 → CWE-787) and crashing the process. A 680-byte font is enough to drive FreeType to a 65536×65536 buffered glyph, wrapping the size to 0. This issue has been patched in version 0.7.7.

• github.comhttps://github.com/mapbox/node-fontnik/pull/202
• github.comhttps://github.com/mapbox/node-fontnik/releases/tag/v0.7.7
• github.comhttps://github.com/mapbox/node-fontnik/security/advisories/GHSA-cfm6-c7rv-58xj