EIP-2026-115631

PRE-CVE

Microsoft DirectWrite / AFDKO - Heap-Based Buffer Overflow in OpenType Font Handling in readEncoding

Title source: legacy
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for EIP-2026-115631. PoCs published by Google Security Research.

AI-analyzed exploit summary This is a detailed technical analysis of a heap buffer overflow vulnerability in AFDKO's readEncoding() function, triggered by malformed OpenType fonts. The writeup includes root cause analysis, crash logs, and proof-of-concept details.

Description

Microsoft DirectWrite / AFDKO - Heap-Based Buffer Overflow in OpenType Font Handling in readEncoding

Exploits (1)

exploitdb WRITEUP VERIFIED
by Google Security Research · textdoswindows
https://www.exploit-db.com/exploits/47093

This is a detailed technical analysis of a heap buffer overflow vulnerability in AFDKO's readEncoding() function, triggered by malformed OpenType fonts. The writeup includes root cause analysis, crash logs, and proof-of-concept details.

Classification
Writeup 100%
Attack Type
Dos
Complexity
Moderate
Reliability
Reliable
Target: AFDKO (Adobe Font Development Kit for OpenType)
No auth needed
Prerequisites: Malformed OpenType font file · Access to a system using AFDKO or DirectWrite with vulnerable code paths
devstral-2 · analyzed Feb 18, 2026 Full analysis →

Details

Status pre_cve
Tracked Since Feb 18, 2026