Description
HarfBuzz is a text shaping engine. Prior to version 12.3.0, a null pointer dereference vulnerability exists in the SubtableUnicodesCache::create function located in src/hb-ot-cmap-table.hh. The function fails to check if hb_malloc returns NULL before using placement new to construct an object at the returned pointer address. When hb_malloc fails to allocate memory (which can occur in low-memory conditions or when using custom allocators that simulate allocation failures), it returns NULL. The code then attempts to call the constructor on this null pointer using placement new syntax, resulting in undefined behavior and a Segmentation Fault. This issue has been patched in version 12.3.0.
Published: 2026-01-10
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Apply Patch
AI Analysis

Impact

The vulnerability is a null‑pointer dereference in the SubtableUnicodesCache::create function of HarfBuzz, which can lead to a segmentation fault when memory allocation fails. This results in a denial of service for applications that depend on the library, as the crash halts execution. The weakness is a classic example of improper null dereference handling, identified by CWE‑476.

Affected Systems

The HarfBuzz text shaping engine from the HarfBuzz project is affected when using any version earlier than 12.3.0. Users of the C/C++ library should review installed versions and upgrade accordingly.

Risk and Exploitability

With a CVSS score of 5.3 the vulnerability is considered moderate, and the EPSS score of less than 1% indicates a very low likelihood of exploitation. HarfBuzz is not listed in the CISA KEV catalog. The required condition is a failure of hb_malloc, which can be triggered by low‑memory environments or custom allocators designed to simulate allocation failures. The attack does not require remote code execution; it is limited to causing application crashes.

Generated by OpenCVE AI on April 18, 2026 at 07:09 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade to HarfBuzz 12.3.0 or later to receive the patch that adds a null check before placement new.
  • Ensure that the application environment provides sufficient memory and avoids custom allocators that simulate allocation failures so that hb_malloc does not return NULL.
  • If an immediate upgrade is not possible, isolate HarfBuzz usage in a separate sandboxed process to prevent a crash from bringing down the entire application.

Generated by OpenCVE AI on April 18, 2026 at 07:09 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 18 Feb 2026 18:00:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:harfbuzz_project:harfbuzz:*:*:*:*:*:*:*:*

Wed, 14 Jan 2026 00:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Moderate

Mon, 12 Jan 2026 17:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 12 Jan 2026 14:45:00 +0000

Type Values Removed Values Added
First Time appeared Harfbuzz Project
Harfbuzz Project harfbuzz
Vendors & Products Harfbuzz Project
Harfbuzz Project harfbuzz

Mon, 12 Jan 2026 06:30:00 +0000

Type Values Removed Values Added
References

Sun, 11 Jan 2026 04:30:00 +0000

Type Values Removed Values Added
References

Sat, 10 Jan 2026 06:00:00 +0000

Type Values Removed Values Added
Description HarfBuzz is a text shaping engine. Prior to version 12.3.0, a null pointer dereference vulnerability exists in the SubtableUnicodesCache::create function located in src/hb-ot-cmap-table.hh. The function fails to check if hb_malloc returns NULL before using placement new to construct an object at the returned pointer address. When hb_malloc fails to allocate memory (which can occur in low-memory conditions or when using custom allocators that simulate allocation failures), it returns NULL. The code then attempts to call the constructor on this null pointer using placement new syntax, resulting in undefined behavior and a Segmentation Fault. This issue has been patched in version 12.3.0.
Title Null Pointer Dereference in SubtableUnicodesCache::create leading to DoS
Weaknesses CWE-476
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'}

Subscriptions

Harfbuzz Project Harfbuzz
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-01-12T16:47:17.715Z

Reserved: 2026-01-08T19:23:09.855Z

Link: CVE-2026-22693

cve-icon Vulnrichment

Updated: 2026-01-12T05:10:58.184Z

cve-icon NVD

Status : Analyzed

Published: 2026-01-10T06:15:52.063

Modified: 2026-02-18T17:49:22.590

Link: CVE-2026-22693

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-01-10T05:53:21Z

Links: CVE-2026-22693 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-04-18T07:15:25Z

Weaknesses