AIKIDO-2026-10356

TL;DR

Affected versions of this package contain an integer overflow in the stch feature handling for malicious fonts, where unchecked multiplication and addition involving repeated glyph expansion can cause the glyph count to wrap, leading to incorrect buffer size calculations. It can allow an attacker to supply a crafted font that causes undersized allocation followed by out-of-bounds writes during shaping, potentially resulting in memory corruption, process crashes, or, in some environments, code execution. An attacker might exploit this by convincing a target application to load or render a specially crafted font file, then triggering text shaping on attacker-controlled content so the malformed glyph expansion path is reached.