Executive brief
Graphite is a smart font rendering engine used to display complex scripts. A vulnerability in how it processes font instructions could allow a specially crafted font file to cause a system crash or potentially allow an attacker to run unauthorized code. This could lead to a loss of data integrity or a complete service outage on systems that process untrusted font files.
Technical details
An integer underflow vulnerability exists in the 'slotat' macro within Graphite's opcode handling (src/inc/opcodes.h). The root cause is a lack of bounds checking to ensure that a calculated offset remains within the valid slot-map range. By providing a crafted font with malicious Graphite actions, an attacker can trigger an underflow that results in an out-of-bounds write prior to the slot-map memory area. This is a local attack vector requiring user interaction, such as opening a document containing a malicious font. The issue is resolved in version 1.3.15.
Affected products
- SIL International Graphite Before 1.3.15
Timeline
- 2026-06-05: disclosed: CVE published to NVD dataset
- 2026-06-05: advisory