CVE-2026-22693
Medium · 5.3CVSS
5.3
EPSS
0.5%
Published
Jan 10, 2026
CISA due date
—
The record
HarfBuzz is a text shaping engine. Prior to version 12.3.0, a null pointer dereference vulnerability exists in the SubtableUnicodesCache::create function located in src/hb-ot-cmap-table.hh. The function fails to check if hb_malloc returns NULL before using placement new to construct an object at the returned pointer address. When hb_malloc fails to allocate memory (which can occur in low-memory conditions or when using custom allocators that simulate allocation failures), it returns NULL. The code then attempts to call the constructor on this null pointer using placement new syntax, resulting in undefined behavior and a Segmentation Fault. This issue has been patched in version 12.3.0.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Mageia:9 | harfbuzz | 0 | 7.0.1-1.2.mga9 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP7 | harfbuzz | 0 | 8.3.0-150600.3.3.1 |
| openSUSE:Leap 15.6 | harfbuzz | 0 | 8.3.0-150600.3.3.1 |
| openSUSE:Leap 16.0 | harfbuzz | 0 | 11.4.5-160000.1.1 |
| openSUSE:Tumbleweed | harfbuzz | 0 | 12.3.0-2.1 |
Related vulnerabilities
- CVE-2024-56732 HarfBuzz is a text shaping engine. Also affects harfbuzz
- CVE-2026-112405 Pillow is a Python imaging library. CWE-476
- CVE-2026-112392 Pillow is a Python imaging library. CWE-476
- CVE-2026-100348 kin-openapi is a Go project for handling OpenAPI files. CWE-476
- CVE-2026-100349 kin-openapi is a Go project for handling OpenAPI files. CWE-476
- CVE-2026-109280 ImageMagick 7.1.0-20 before 7.1.2-32 contains a use after free vulnerability in the -fx… CWE-476
- CVE-2026-109272 ImageMagick 7.1.1-31 before 7.1.2-32 contains a NULL pointer dereference in the… CWE-476
- CVE-2026-109258 ImageMagick 7.1.0-20 before 7.1.2-32 contains an invalid memory free vulnerability in the… CWE-476