{"affected":[{"product":"node-fontnik","source":"CNA: GitHub_M","vendor":"mapbox","versions":[{"status":"affected","version":"< 0.7.7"}]}],"cveId":"CVE-2026-63660","cwes":["CWE-190","CWE-787"],"description":"node-fontnik is a library that delivers a range of glyphs rendered as SDFs (signed distance fields) in a protocol buffer. Prior to version 0.7.7, a crafted font could trigger a heap out-of-bounds write in RenderSDF (include/mapbox/glyph_foundry_impl.hpp). RenderSDF computed the SDF bitmap allocation size as buffered_width * buffered_height in 32-bit unsigned int. Glyph dimensions are derived from the uploaded font's outline bounding box with no upper bound, so a glyph large enough to make that product exceed 2³² wrapped to a small value. The buffer was then under-allocated while the render loop still wrote one byte per pixel, corrupting the heap (CWE-190 → CWE-787) and crashing the process. A 680-byte font is enough to drive FreeType to a 65536×65536 buffered glyph, wrapping the size to 0. This issue has been patched in version 0.7.7.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":8.1,"severity":"high","source":"CNA: GitHub_M","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","version":"3.1"}],"modifiedAt":1794364847419,"publishedAt":1794364847419,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/mapbox/node-fontnik/security/advisories/GHSA-cfm6-c7rv-58xj"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/mapbox/node-fontnik/pull/202"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/mapbox/node-fontnik/releases/tag/v0.7.7"}],"remediation":[],"revision":"aed41291cd02cd9da39e87c2ce699701c592511feb2bf544c4c23ab5e72261db","sources":[{"modifiedAt":1794364847419,"name":"CNA: GitHub_M","retrievedAt":1794366530281,"url":"https://www.cve.org/CVERecord?id=CVE-2026-63660"}],"ssvc":null,"status":"published","title":"node-fontnik: integer-overflow heap out-of-bounds write in RenderSDF","updatedAt":1794366530281}