CVE-2026-63660

node-fontnik is a library that delivers a range of glyphs rendered as SDFs (signed distance fields) in a protocol buffer.

node-fontnik is a library that delivers a range of glyphs rendered as SDFs (signed distance fields) in a protocol buffer. Prior to version 0.7.7, a crafted font could trigger a heap out-of-bounds write in RenderSDF (include/mapbox/glyph_foundry_impl.hpp). RenderSDF computed the SDF bitmap allocation size as buffered_width * buffered_height in 32-bit unsigned int. Glyph dimensions are derived from the uploaded font's outline bounding box with no upper bound, so a glyph large…

11. Nov 2026

Ausgewertete Quellen

• NVD
  CVE-2026-63660