Mapbox node-fontnik: Integer overflow leads to heap out-of-bounds write
Summary
node-fontnik is a library that renders font glyphs as signed distance fields for map and text rendering pipelines. In versions before 0.7.7, a crafted font file can cause an integer overflow in the SDF bitmap size calculation, which leads to a heap out-of-bounds write and a crash of the process. The attacker needs to be able to supply a font file to an application that renders it and needs low privileges on the system.
Affected
- node-fontnik (npm package fontnik) before 0.7.7
- Affected range per CVE record: before 0.7.7
Fixed in
- Fixed in node-fontnik 0.7.7
Workaround
Unknown.
Exploitation
- No known exploitation in the wild; not listed in CISA KEV at time of research.
- No public proof-of-concept exploit found at time of research.
Our recommendation
- Upgrade node-fontnik to 0.7.7 or later and rebuild dependent images or bundles.
- Check whether node-fontnik appears in SBOMs or package-lock.json files, and verify the installed version with npm view or npm ls.
- Where applications accept user-supplied font files, restrict or reject such uploads until the update is applied.
- Monitor for crashes of services that render glyphs.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-cfm6-c7rv-58xj github.com
- Pull Request #202: Fix integer-overflow heap out-of-bounds write in RenderSDF github.com
- Release v0.7.7 github.com
- OffSeq threat radar entry for CVE-2026-63660 radar.offseq.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 04:21.
Original description (NVD)
node-fontnik is a library that delivers a range of glyphs rendered as SDFs (signed distance fields) in a protocol buffer. Prior to version 0.7.7, a crafted font could trigger a heap out-of-bounds write in RenderSDF (include/mapbox/glyph_foundry_impl.hpp). RenderSDF computed the SDF bitmap allocation size as buffered_width * buffered_height in 32-bit unsigned int. Glyph dimensions are derived from the uploaded font's outline bounding box with no upper bound, so a glyph large enough to make that product exceed 2³² wrapped to a small value. The buffer was then under-allocated while the render loop still wrote one byte per pixel, corrupting the heap (CWE-190 → CWE-787) and crashing the process. A 680-byte font is enough to drive FreeType to a 65536×65536 buffered glyph, wrapping the size to 0. This issue has been patched in version 0.7.7.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.