Skip to content
OpenAdvisories

Package · Debian

harfbuzz

9 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 5.5
    CVE-2026-113680

    HarfBuzz 8.0.0 through 14.6.0 WebAssembly Shaper NULL Pointer Dereference DoS

    HarfBuzz from 8.0.0 through 14.6.0 contains a NULL pointer dereference vulnerability in the experimental WebAssembly shaper host imports buffer_set_contents, face_create, and font_set_coords. Attackers can supply a crafted font whose embedded wasm module pass…

    harfbuzz harfbuzz harfbuzz harfbuzz Debian Ubuntu
  • Medium 5.3
    CVE-2026-22693

    Null Pointer Dereference in SubtableUnicodesCache::create leading to DoS

    HarfBuzz is a text shaping engine. Prior to version 12.3.0, a null pointer dereference vulnerability exists in the SubtableUnicodesCache::create function located in src/hb-ot-cmap-table.hh. The function fails to check if hb_malloc returns NULL before using pl…

    harfbuzz harfbuzz harfbuzz harfbuzz Debian Ubuntu