Description
HarfBuzz is a text shaping engine. Starting with 8.5.0 through 10.0.1, there is a heap-based buffer overflow in the hb_cairo_glyphs_from_buffer function.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| harfbuzz | harfbuzz | >= 8.5.0, <= 10.0.1 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | harfbuzz | 10.1.0-2 | — |
| Debian 13 | harfbuzz | 10.1.0-2 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.04 LTS | harfbuzz | 10.2.0-1 | — |
| Ubuntu 25.10 | harfbuzz | 10.2.0-1 | — |
| Ubuntu 18.04 LTS | harfbuzz | No fix yet | — |
| Ubuntu 14.04 LTS | harfbuzz | No fix yet | — |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 16.04 LTS | harfbuzz | No fix yet | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | harfbuzz | 10.1.0-2.1 | openSUSE-SU-2025:14614-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | harfbuzz +2 | 7.0.0-2.amzn2023.0.2 | ALAS2023-2025-848 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | harfbuzz | 8.3.0-3 | — |
| Azure Linux 3 | qtbase | 6.6.3-2 | — |
Advisories 2
- openSUSE-SU-2025:14614-1 harfbuzz-devel-10.1.0-2.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- ALAS2023-2025-848 Moderate: harfbuzz security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Feb 21, 2025