Is CVE-2026-110605 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-110605?

CVE-2026-110605 has a CVSS v3 severity of MEDIUM (5.5).

Back

CVE-2026-110605

Description

libschrift through 0.10.2 contains a divide by zero vulnerability that allows attackers to crash applications by supplying a font with unitsPerEm of 0 in the head table. Attackers can provide a crafted TrueType font whose NaN glyph coordinates bypass clip_points(), causing an out-of-bounds raster read in draw_line() during sft_render() and crashing the process.