CVE-2015-9274

What it actually does

Invalid two-byte read in GPOS and GSUB table parsing leads to application crash via memory corruption.

Why it matters to the business

Applications that render text with embedded or user-supplied fonts can be forced to terminate unexpectedly, interrupting services and user workflows.

How an attack unfolds

An attacker supplies a specially crafted OpenType font containing malformed GPOS or GSUB tables; when the vulnerable HarfBuzz library parses the font during text layout, the mishandled tables trigger an out-of-bounds read and immediate crash.

How to fix it

Upgrade HarfBuzz to version 1.0.4 or later; rebuild and redeploy all dependent applications and libraries.

How to confirm the fix worked

Confirm installed HarfBuzz version is at least 1.0.4; attempt to render text using a test font that previously triggered the crash and verify the application no longer terminates.

Typical attack path

1. Attacker crafts malicious OpenType font with invalid GPOS/GSUB data
2. Malicious font is delivered via document, web page, or message
3. Target application loads the font using vulnerable HarfBuzz for text shaping
4. Library performs invalid memory read and crashes

How to detect it

Review application crash logs and core dumps that occur during font loading or text layout operations; correlate with receipt of untrusted documents or web content containing embedded fonts.

What your security team should do

• Identify and inventory all products and containers that statically or dynamically link HarfBuzz
• Prioritize upgrade of any internet-facing or user-content-processing services
• Add HarfBuzz version checks to build pipelines and dependency scanners
• Monitor vendor advisories for downstream packages that bundle older HarfBuzz