CVE catalog

CVE-2026-22693

harfbuzz: CVE-2026-22693

Severity: Medium · CVSS 5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Published: Jan 10, 2026, 5:53:21 AM UTC
Source: [NVD] · [CVE record]
EPSS: 0.45% · Oct 25, 2026

HarfBuzz is a text shaping engine. Prior to version 12.3.0, a null pointer dereference vulnerability exists in the SubtableUnicodesCache::create function located in src/hb-ot-cmap-table.hh. The function fails to check if hb_malloc returns NULL before using placement new to construct an object at the returned pointer address. When hb_malloc fails to allocate memory (which can occur in low-memory conditions or when using custom allocators that simulate allocation failures), it returns NULL. The code then attempts to call the constructor on this null pointer using placement new syntax, resulting in undefined behavior and a Segmentation Fault. This issue has been patched in version 12.3.0.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	harfbuzz	sid	`12.3.2-2`	fixed
Debian	harfbuzz	forky	`12.3.2-2`	fixed
Debian	harfbuzz	trixie	`10.2.0-1+deb13u1`	fixed
Debian	harfbuzz	bookworm	`6.0.0+dfsg-3`	vulnerable
Ubuntu	harfbuzz	24.04	`8.0.1-1`	vulnerable
Ubuntu	harfbuzz	24.04	`8.0.1-1build1`	vulnerable
Ubuntu	harfbuzz	24.04	`8.3.0-2`	vulnerable
Ubuntu	harfbuzz	24.04	`8.3.0-2build1`	vulnerable
Ubuntu	harfbuzz	24.04	`8.3.0-2build2`	vulnerable
Ubuntu	harfbuzz	25.10	`10.2.0-1`	vulnerable
Suse	harfbuzz	linux enterprise server 16.0	`11.4.5-160000.1.1`	fixed
Suse	harfbuzz	linux enterprise server for sap applications 16.0	`11.4.5-160000.1.1`	fixed
Opensuse	harfbuzz	leap 16.0	`11.4.5-160000.1.1`	fixed
Suse	harfbuzz	linux micro 6.2	`11.4.5-160000.1.1`	fixed
Opensuse	harfbuzz	tumbleweed	`12.3.0-2.1`	fixed
Suse	harfbuzz	linux enterprise module for basesystem 15 sp7	`8.3.0-150600.3.3.1`	fixed
Opensuse	harfbuzz	leap 15.6	`8.3.0-150600.3.3.1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	harfbuzz	source	sid	`12.3.0-4`	not yet assigned	Not reported	[1125189]
Debian	harfbuzz	source	forky	`12.3.0-4`	not yet assigned	Not reported	[1125189]
Debian	harfbuzz	source	trixie	`10.2.0-1+deb13u1`	not yet assigned	Not reported	[1125189]
Debian	harfbuzz	source	bookworm	`(unfixed)`	not yet assigned	Not reported	[1125189]
Suse	harfbuzz	rpm	linux enterprise server 16.0	`11.4.5-160000.1.1`	Not reported	SUSE-SU-2026:20922-1	Not reported
Suse	harfbuzz	rpm	linux enterprise server for sap applications 16.0	`11.4.5-160000.1.1`	Not reported	SUSE-SU-2026:20922-1	Not reported
Opensuse	harfbuzz	rpm	leap 16.0	`11.4.5-160000.1.1`	Not reported	OPENSUSE-SU-2026:20409-1	Not reported
Suse	harfbuzz	rpm	linux micro 6.2	`11.4.5-160000.1.1`	Not reported	SUSE-SU-2026:20762-1	Not reported
Opensuse	harfbuzz	rpm	tumbleweed	`12.3.0-2.1`	Not reported	OPENSUSE-SU-2026:10065-1	Not reported
Suse	harfbuzz	rpm	linux enterprise module for basesystem 15 sp7	`8.3.0-150600.3.3.1`	Not reported	SUSE-SU-2026:0287-1	Not reported
Opensuse	harfbuzz	rpm	leap 15.6	`8.3.0-150600.3.3.1`	Not reported	SUSE-SU-2026:0287-1	Not reported

[Debian bug #1125189]

Notes

[bookworm] harfbuzz: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[gir1.2-harfbuzz-0.0]Affected
Source package: [harfbuzz]
Details (2)
- 6.0.0+dfsg-3 · amd64 · bookworm
  Affected
  dsa · harfbuzz · debian · bookworm; dsa · harfbuzz · debian · 12
- 6.0.0+dfsg-3 · arm64 · bookworm
  Affected
  dsa · harfbuzz · debian · bookworm; dsa · harfbuzz · debian · 12
[libharfbuzz0b]Affected
Source package: [harfbuzz]
Details (2)
- 6.0.0+dfsg-3 · amd64 · bookworm
  Affected
  dsa · harfbuzz · debian · bookworm; dsa · harfbuzz · debian · 12
- 6.0.0+dfsg-3 · arm64 · bookworm
  Affected
  dsa · harfbuzz · debian · bookworm; dsa · harfbuzz · debian · 12
[libharfbuzz-bin]Affected
Source package: [harfbuzz]
Details (2)
- 6.0.0+dfsg-3 · amd64 · bookworm
  Affected
  dsa · harfbuzz · debian · bookworm; dsa · harfbuzz · debian · 12
- 6.0.0+dfsg-3 · arm64 · bookworm
  Affected
  dsa · harfbuzz · debian · bookworm; dsa · harfbuzz · debian · 12
[libharfbuzz-dev]Affected
Source package: [harfbuzz]
Details (2)
- 6.0.0+dfsg-3 · amd64 · bookworm
  Affected
  dsa · harfbuzz · debian · bookworm; dsa · harfbuzz · debian · 12
- 6.0.0+dfsg-3 · arm64 · bookworm
  Affected
  dsa · harfbuzz · debian · bookworm; dsa · harfbuzz · debian · 12
[libharfbuzz-doc]Affected
Source package: [harfbuzz]
Details (2)
- 6.0.0+dfsg-3 · all · bookworm
  Affected
  dsa · harfbuzz · debian · bookworm; dsa · harfbuzz · debian · 12
- 6.0.0+dfsg-3 · all · bookworm
  Affected
  dsa · harfbuzz · debian · bookworm; dsa · harfbuzz · debian · 12
[libharfbuzz-gobject0]Affected
Source package: [harfbuzz]
Details (2)
- 6.0.0+dfsg-3 · amd64 · bookworm
  Affected
  dsa · harfbuzz · debian · bookworm; dsa · harfbuzz · debian · 12
- 6.0.0+dfsg-3 · arm64 · bookworm
  Affected
  dsa · harfbuzz · debian · bookworm; dsa · harfbuzz · debian · 12
[libharfbuzz-icu0]Affected
Source package: [harfbuzz]
Details (2)
- 6.0.0+dfsg-3 · amd64 · bookworm
  Affected
  dsa · harfbuzz · debian · bookworm; dsa · harfbuzz · debian · 12
- 6.0.0+dfsg-3 · arm64 · bookworm
  Affected
  dsa · harfbuzz · debian · bookworm; dsa · harfbuzz · debian · 12
[libharfbuzz-subset0]Affected
Source package: [harfbuzz]
Details (2)
- 6.0.0+dfsg-3 · amd64 · bookworm
  Affected
  dsa · harfbuzz · debian · bookworm; dsa · harfbuzz · debian · 12
- 6.0.0+dfsg-3 · arm64 · bookworm
  Affected
  dsa · harfbuzz · debian · bookworm; dsa · harfbuzz · debian · 12

[openSUSE Tumbleweed]

[harfbuzz-devel]Unknown
Source package: [harfbuzz]
Details (1)
- 14.3.1-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 12.3.0-2.1
  Version impact unknown
  dsa · harfbuzz · opensuse · tumbleweed
[harfbuzz-tools]Unknown
Source package: [harfbuzz]
Details (1)
- 14.3.1-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 12.3.0-2.1
  Version impact unknown
  dsa · harfbuzz · opensuse · tumbleweed
[libharfbuzz0]Unknown
Source package: [harfbuzz]
Details (1)
- 14.3.1-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 12.3.0-2.1
  Version impact unknown
  dsa · harfbuzz · opensuse · tumbleweed
[libharfbuzz0-32bit]Unknown
Source package: [harfbuzz]
Details (1)
- 14.3.1-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 12.3.0-2.1
  Version impact unknown
  dsa · harfbuzz · opensuse · tumbleweed
[libharfbuzz-cairo0]Unknown
Source package: [harfbuzz]
Details (1)
- 14.3.1-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 12.3.0-2.1
  Version impact unknown
  dsa · harfbuzz · opensuse · tumbleweed
[libharfbuzz-cairo0-32bit]Unknown
Source package: [harfbuzz]
Details (1)
- 14.3.1-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 12.3.0-2.1
  Version impact unknown
  dsa · harfbuzz · opensuse · tumbleweed
[libharfbuzz-gobject0]Unknown
Source package: [harfbuzz]
Details (1)
- 14.3.1-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 12.3.0-2.1
  Version impact unknown
  dsa · harfbuzz · opensuse · tumbleweed
[libharfbuzz-gobject0-32bit]Unknown
Source package: [harfbuzz]
Details (1)
- 14.3.1-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 12.3.0-2.1
  Version impact unknown
  dsa · harfbuzz · opensuse · tumbleweed
[libharfbuzz-gpu0]Unknown
Source package: [harfbuzz]
Details (1)
- 14.3.1-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 12.3.0-2.1
  Version impact unknown
  dsa · harfbuzz · opensuse · tumbleweed
[libharfbuzz-icu0]Unknown
Source package: [harfbuzz]
Details (1)
- 14.3.1-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 12.3.0-2.1
  Version impact unknown
  dsa · harfbuzz · opensuse · tumbleweed
[libharfbuzz-icu0-32bit]Unknown
Source package: [harfbuzz]
Details (1)
- 14.3.1-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 12.3.0-2.1
  Version impact unknown
  dsa · harfbuzz · opensuse · tumbleweed
[libharfbuzz-raster0]Unknown
Source package: [harfbuzz]
Details (1)
- 14.3.1-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 12.3.0-2.1
  Version impact unknown
  dsa · harfbuzz · opensuse · tumbleweed

Next results

Observed: Oct 24, 2026, 7:41:40 AM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]