Node-Fontnik < 0.7.7 (< 0.7.7) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/node-fontnik--0.7.7--0.7.7/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 11 Nov 2026 20:06:10 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgHeap-based buffer overflow in node-fontnik (CVE-2026-63660)https://feed.craftedsignal.io/briefs/2026-11-node-fontnik-heap-overflow-cve-2026-63660/Wed, 11 Nov 2026 20:06:10 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-node-fontnik-heap-overflow-cve-2026-63660/The node-fontnik library is vulnerable to a heap out-of-bounds write due to an integer overflow during SDF bitmap allocation, which can lead to process crashes.node-fontnik is a library that delivers a range of glyphs rendered as SDFs. A vulnerability exists in the RenderSDF function where the allocation size for the SDF bitmap is computed using a 32-bit unsigned integer. An attacker can provide a crafted font to cause an integer overflow, resulting in an under-allocated heap buffer. This triggers a heap out-of-bounds write during the render loop, which crashes the process.

Impact

Successful exploitation results in process crashes and heap corruption.

Recommendation

Upgrade the node-fontnik library to version 0.7.7 or later.

]]>mediumadvisory