Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-63660— node-fontnik: integer-overflow heap out-of-bounds write in RenderSDF

Quick assessment

Affected
mapbox node-fontnik
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

node-fontnik 是一个库，它通过 Protocol Buffer 协议提供一系列以 SDF（有符号距离场）形式渲染的字形。在 0.7.7 版本之前，经过精心构造的字体可触发 RenderSDF 函数（位于 include/mapbox/glyph_foundry_impl.hpp）中的堆越界写入漏洞。 RenderSDF 在计算 SDF 位图分配大小时，使用 32 位无符号整数执行 buffered_width * buffered_height 运算。字形的尺寸源自上传字体的轮廓边界框，且未设置上限。因

CVSS 8.1 · High

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-63660

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
node-fontnik: integer-overflow heap out-of-bounds write in RenderSDF
Source: CVE Program / CVE List V5
Vulnerability Description
node-fontnik is a library that delivers a range of glyphs rendered as SDFs (signed distance fields) in a protocol buffer. Prior to version 0.7.7, a crafted font could trigger a heap out-of-bounds write in RenderSDF (include/mapbox/glyph_foundry_impl.hpp). RenderSDF computed the SDF bitmap allocation size as buffered_width * buffered_height in 32-bit unsigned int. Glyph dimensions are derived from the uploaded font's outline bounding box with no upper bound, so a glyph large enough to make that product exceed 2³² wrapped to a small value. The buffer was then under-allocated while the render loop still wrote one byte per pixel, corrupting the heap (CWE-190 → CWE-787) and crashing the process. A 680-byte font is enough to drive FreeType to a 65536×65536 buffered glyph, wrapping the size to 0. This issue has been patched in version 0.7.7.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
整数溢出或超界折返
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
mapbox node-fontnik < 0.7.7 -

II. Public POCs for CVE-2026-63660

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-63660

请登录查看更多情报信息。

Other References for CVE-2026-63660 (3)

IV. Related Vulnerabilities

Same vendor: mapbox
Same weakness: CWE-190