CVE-2026-110605

MEDIUM 5.5

libschrift through 0.10.2 Divide by Zero via unitsPerEm in draw_line

CVSS Score

5.5

EPSS Score

0.0%

EPSS Percentile

0th

libschrift through 0.10.2 contains a divide by zero vulnerability that allows attackers to crash applications by supplying a font with unitsPerEm of 0 in the head table. Attackers can provide a crafted TrueType font whose NaN glyph coordinates bypass clip_points(), causing an out-of-bounds raster read in draw_line() during sft_render() and crashing the process.

CWE	CWE-369
Vendor	tomolt
Product	libschrift
Published	Oct 14, 2026

Stay Ahead of the Next One

Get instant alerts for tomolt libschrift

Be the first to know when new medium vulnerabilities affecting tomolt libschrift are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Affected Versions

tomolt / libschrift

0 ≤ 0.10.2

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/tomolt/libschrift/issues/46 hackmd.io: https://hackmd.io/@haind-pwn/libschrift-unitsperem-zero-oob github.com: https://github.com/tomolt/libschrift/blob/v0.10.2/schrift.c#L542 github.com: https://github.com/tomolt/libschrift/blob/v0.10.2/schrift.c#L1422-L1503 vulncheck.com: https://www.vulncheck.com/advisories/libschrift-through-0.10.2-divide-by-zero-via-unitsperem-in-draw-line

Credits

WTCYJ HaiND from the Post and Telecommunication Institute of Technology