Skip to content
Fencer Intel
medium 5.3

CVE-2026-22693 json

Null Pointer Dereference in SubtableUnicodesCache::create leading to DoS

published 9mo ago modified 3mo ago also EUVD-2026-1871 , JLSEC-2026-777

cvss
5.3
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.5%
EPSS 0.5% chance of exploitation in 30 days, percentile 39%
public exploits
0
none known

Summary

HarfBuzz is a text shaping engine. Prior to version 12.3.0, a null pointer dereference vulnerability exists in the SubtableUnicodesCache::create function located in src/hb-ot-cmap-table.hh. The function fails to check if hb_malloc returns NULL before using placement new to construct an object at the returned pointer address. When hb_malloc fails to allocate memory (which can occur in low-memory conditions or when using custom allocators that simulate allocation failures), it returns NULL. The code then attempts to call the constructor on this null pointer using placement new syntax, resulting in undefined behavior and a Segmentation Fault. This issue has been patched in version 12.3.0.

Patch / fix

  • julia HarfBuzz_ICU_jll 100.14002.1+0
  • julia HarfBuzz_jll 100.14002.1+0
  • harfbuzz_project harfbuzz 12.3.0
  • harfbuzz Debian 13 10.2.0-1+deb13u1
  • harfbuzz Debian 14 12.3.0-4

debian advisories DEBIAN-CVE-2026-22693

  • harfbuzz hummingbird 1 14.1.0-2.hum1
  • harfbuzz-gpu hummingbird 1 14.1.0-2.hum1
  • harfbuzz-icu hummingbird 1 14.1.0-2.hum1
  • harfbuzz-cairo hummingbird 1 14.1.0-2.hum1
  • harfbuzz-raster hummingbird 1 14.1.0-2.hum1
  • harfbuzz-vector hummingbird 1 14.1.0-2.hum1

red hat advisories RHSA-2026:7701

  • harfbuzz SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 11.4.5-160000.1.1
  • harfbuzz SLE Module for Basesystem 15 SP7, openSUSE Leap 15.6 8.3.0-150600.3.3.1

suse advisories SUSE-SU-2026:20762-1SUSE-SU-2026:20922-1SUSE-SU-2026:0287-1

  • harfbuzz openSUSE Leap 16.0 11.4.5-160000.1.1
  • harfbuzz openSUSE Tumbleweed 12.3.0-2.1

opensuse advisories openSUSE-SU-2026:20409-1openSUSE-SU-2026:10065-1

  • harfbuzz Azure Linux 3.0 8.3.0-4

azure linux advisories AZL-73970

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Is CVE-2026-22693 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-22693 updated cvss 5.3

harfbuzz: Null Pointer Dereference in harfbuzz

  • Red Hat build of OpenJDK 11 ELS java-11-openjdk, java-11-openjdk-portable Red Hat build of OpenJDK 17 java-17-openjdk-portable Red Hat build of OpenJDK 21 java-21-openjdk-portable Red Hat build of OpenJDK 25 java-25-openjdk-portable Red Hat Enterprise Linux 7 firefox, harfbuzz, harfbuzz-icu Red Hat Enterprise Linux 8 firefox, harfbuzz, thunderbird, harfbuzz-icu, java-17-openjdk, java-21-openjdk, +44 more
    +2 more products
    Red Hat Enterprise Linux 9 firefox, harfbuzz, firefox-x11, thunderbird, harfbuzz-icu, java-17-openjdk, +68 more Red Hat Enterprise Linux 10 firefox, harfbuzz, thunderbird, java-21-openjdk, java-25-openjdk
    affected: workaround, no fix available “Fix deferred”
  • Red Hat Hardened Images harfbuzz 14.1.0-2.hum1, harfbuzz-gpu 14.1.0-2.hum1, harfbuzz-icu 14.1.0-2.hum1, harfbuzz-cairo 14.1.0-2.hum1, harfbuzz-raster 14.1.0-2.hum1, harfbuzz-vector 14.1.0-2.hum1
    fixed: vendor fix RHSA-2026:7701

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
9mo ago

Exploit prediction

0.45% chance of exploitation in the next 30 days, higher than 39% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

  • openwall.com http://www.openwall.com/lists/oss-security/2026/01/11/1 referenced PoC, tagged "exploit" by a source, unverified
  • openwall.com http://www.openwall.com/lists/oss-security/2026/01/12/1 referenced PoC, tagged "exploit" by a source, unverified
  • github.com https://github.com/harfbuzz/harfbuzz/security/advisories/GHSA-xvjr-f2r9-c7ww referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
OSV 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Affected packages

ecosystem package affected fixed in
julia HarfBuzz_ICU_jll
<100.14002.1+0
100.14002.1+0
julia HarfBuzz_jll
<100.14002.1+0
100.14002.1+0

Affected products

  • harfbuzz harfbuzz

Classification

Weakness

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.