CVE-2026-22693
MEDIUM EPSS 29.6%
Published Jan 10, 20265mo ago · Modified Jun 17, 20261w ago
5.3 CVSS 3.1
Published Jan 10, 2026 5mo ago
Last Modified Jun 17, 2026 1w ago
Description
HarfBuzz is a text shaping engine. Prior to version 12.3.0, a null pointer dereference vulnerability exists in the SubtableUnicodesCache::create function located in src/hb-ot-cmap-table.hh. The function fails to check if hb_malloc returns NULL before using placement new to construct an object at the returned pointer address. When hb_malloc fails to allocate memory (which can occur in low-memory conditions or when using custom allocators that simulate allocation failures), it returns NULL. The code then attempts to call the constructor on this null pointer using placement new syntax, resulting in undefined behavior and a Segmentation Fault. This issue has been patched in version 12.3.0.
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality None
Integrity None
Availability Low
Threat Intelligence
EPSS Exploit Probability
29.6% percentile
Exploit & Patch Status
Public Exploit Known
Patch Available
Weaknesses 1
CWE-476 NULL Pointer Dereference Memory Safety
Affected Products 1
| Vendor | Product | Version | Range |
|---|---|---|---|
| harfbuzz_project | harfbuzz | * | <12.3.0 |
References 4
- openwall.com http://www.openwall.com/lists/oss-security/2026/01/11/1
- openwall.com http://www.openwall.com/lists/oss-security/2026/01/12/1
- github.com https://github.com/harfbuzz/harfbuzz/commit/1265ff8d990284f04d8768f35b0e20ae5f60daae
- github.com https://github.com/harfbuzz/harfbuzz/security/advisories/GHSA-xvjr-f2r9-c7ww
Remediation
- openwall.com http://www.openwall.com/lists/oss-security/2026/01/11/1
- openwall.com http://www.openwall.com/lists/oss-security/2026/01/12/1
- github.com https://github.com/harfbuzz/harfbuzz/commit/1265ff8d990284f04d8768f35b0e20ae5f60daae