Aziz Elbelaychy

HarfBuzz 8.0.0 through 14.6.0 contains an out-of-bounds write vulnerability in the experimental WebAssembly shaper because the font glyph to string import has a wrong WAMR signature. Attackers can supply a crafted font whose wasm module places the output buffer near linear memory's end, writing glyph-name bytes into host memory to crash or corrupt applications.

HarfBuzz from 8.0.0 through 14.6.0 contains a NULL pointer dereference vulnerability in the experimental WebAssembly shaper host imports buffer set contents, face create, and font set coords. Attackers can supply a crafted font whose embedded wasm module passes out-of-range addresses with non-zero lengths, crashing any application that shapes text with the font.

**Name of the Vulnerable Software and Affected Versions** Poppler versions 0.42.0 through 26.10.0 **Description** A stack-based buffer overflow exists in the `Decrypt::revision6Hash()` function. This occurs when opening PDFs encrypted with AESV3/R6 if a password longer than 127 bytes is provided. Attackers can use applications utilizing the libpoppler, libpoppler-glib, or C++ API to overflow the `K1` and `E` buffers, which may lead to process crashes or memory corruption. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.