Vulnerability · Published Oct 14, 2026 · Assigned by VulnCheck
CVE-2026-110605libschrift through 0.10.2 Divide by Zero via unitsPerEm in draw_line
Medium 5.5
In plain English
A medium-severity security flaw in libschrift from tomolt. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 20% of all known vulnerabilities).
Severity (CVSS 3.1)5.5Medium
Exploit odds (30 days)0.3%top 79.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
libschrift through 0.10.2 contains a divide by zero vulnerability that allows attackers to crash applications by supplying a font with unitsPerEm of 0 in the head table. Attackers can provide a crafted TrueType font whose NaN glyph coordinates bypass clip_points(), causing an out-of-bounds raster read in draw_line() during sft_render() and crashing the process.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| tomolt | libschrift | 0 – through 0.10.2 |
Weakness: CWE-369 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
References
- https://github.com/tomolt/libschrift/issues/46 issue-tracking
- https://hackmd.io/@haind-pwn/libschrift-unitsperem-zero-oob third-party-advisory
- https://github.com/tomolt/libschrift/blob/v0.10.2/schrift.c#L542 technical-description
- https://github.com/tomolt/libschrift/blob/v0.10.2/schrift.c#L1422-L1503 technical-description
- VulnCheck Advisory: libschrift through 0.10.2 Divide by Zero via unitsPerEm in draw_line third-party-advisory