Vulnerability-Lookup

Search criteria

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CVE-2026-113680 (GCVE-0-2026-113680)

Vulnerability from nvd – Published: 2026-10-20 15:40 – Updated: 2026-10-20 15:40

Title

HarfBuzz 8.0.0 through 14.6.0 WebAssembly Shaper NULL Pointer Dereference DoS

Summary

HarfBuzz from 8.0.0 through 14.6.0 contains a NULL pointer dereference vulnerability in the experimental WebAssembly shaper host imports buffer_set_contents, face_create, and font_set_coords. Attackers can supply a crafted font whose embedded wasm module passes out-of-range addresses with non-zero lengths, crashing any application that shapes text with the font.

Severity

6.8 (Medium)


                        
                          CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

CWE

CWE-476 - NULL Pointer Dereference

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 6614 records in the last 180 days details

References

6 references

URL	Tags
https://github.com/harfbuzz/harfbuzz/pull/6414	patchissue-tracking
https://github.com/harfbuzz/harfbuzz/commit/a71aa…	patch
https://github.com/harfbuzz/harfbuzz/blob/14.6.0/…	technical-description
https://github.com/harfbuzz/harfbuzz/blob/14.6.0/…	technical-description
https://github.com/harfbuzz/harfbuzz/blob/14.6.0/…	technical-description
https://www.vulncheck.com/advisories/harfbuzz-8.0…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
harfbuzz	harfbuzz	Affected: 8.0.0 , ≤ 14.6.0 (semver) cpe:2.3:a:harfbuzz_project:harfbuzz::::::::

Date Public

2026-10-19 21:41

Credits

Aziz Elbelaychy (Ostorlab)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/harfbuzz/harfbuzz",
          "product": "harfbuzz",
          "repo": "https://github.com/harfbuzz/harfbuzz",
          "vendor": "harfbuzz",
          "versions": [
            {
              "lessThanOrEqual": "14.6.0",
              "status": "affected",
              "version": "8.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:harfbuzz_project:harfbuzz:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "14.6.0",
                  "versionStartIncluding": "8.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Aziz Elbelaychy (Ostorlab)"
        }
      ],
      "datePublic": "2026-10-19T21:41:19.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "HarfBuzz from 8.0.0 through 14.6.0 contains a NULL pointer dereference vulnerability in the experimental WebAssembly shaper host imports buffer_set_contents, face_create, and font_set_coords. Attackers can supply a crafted font whose embedded wasm module passes out-of-range addresses with non-zero lengths, crashing any application that shapes text with the font."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-476",
              "description": "NULL Pointer Dereference",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-20T15:40:41.101Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "patch",
            "issue-tracking"
          ],
          "url": "https://github.com/harfbuzz/harfbuzz/pull/6414"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/harfbuzz/harfbuzz/commit/a71aa86c2bac114fafb6b47f8da02024ecb44fa6"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/harfbuzz/harfbuzz/blob/14.6.0/src/hb-wasm-api-buffer.hh#L153-L181"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/harfbuzz/harfbuzz/blob/14.6.0/src/hb-wasm-api-face.hh#L34-L49"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/harfbuzz/harfbuzz/blob/14.6.0/src/hb-wasm-api-font.hh#L241-L258"
        },
        {
          "name": "VulnCheck Advisory: HarfBuzz 8.0.0 through 14.6.0 WebAssembly Shaper NULL Pointer Dereference DoS",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/harfbuzz-8.0.0-through-14.6.0-webassembly-shaper-null-pointer-dereference-dos"
        }
      ],
      "title": "HarfBuzz 8.0.0 through 14.6.0 WebAssembly Shaper NULL Pointer Dereference DoS",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-113680",
    "datePublished": "2026-10-20T15:40:41.101Z",
    "dateReserved": "2026-10-20T14:51:02.127Z",
    "dateUpdated": "2026-10-20T15:40:41.101Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-113679 (GCVE-0-2026-113679)

Vulnerability from nvd – Published: 2026-10-20 15:40 – Updated: 2026-10-20 16:21

Title

HarfBuzz 8.0.0 through 14.6.0 Out-of-Bounds Write via WebAssembly font_glyph_to_string

Summary

HarfBuzz 8.0.0 through 14.6.0 contains an out-of-bounds write vulnerability in the experimental WebAssembly shaper because the font_glyph_to_string import has a wrong WAMR signature. Attackers can supply a crafted font whose wasm module places the output buffer near linear memory's end, writing glyph-name bytes into host memory to crash or corrupt applications.

Severity

7.3 (High)


                        
                          CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

7 (High)


                        
                          CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-20 16:21 UTC

CWE

CWE-787 - Out-of-bounds Write

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 6614 records in the last 180 days details

References

5 references

URL	Tags
https://github.com/harfbuzz/harfbuzz/pull/6414	patchissue-tracking
https://github.com/harfbuzz/harfbuzz/commit/5e821…	patch
https://github.com/harfbuzz/harfbuzz/blob/14.6.0/…	technical-description
https://github.com/harfbuzz/harfbuzz/blob/14.6.0/…	technical-description
https://www.vulncheck.com/advisories/harfbuzz-8.0…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
harfbuzz	harfbuzz	Affected: 8.0.0 , ≤ 14.6.0 (semver) cpe:2.3:a:harfbuzz_project:harfbuzz::::::::

Date Public

2026-10-19 21:41

Credits

Aziz Elbelaychy (Ostorlab)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-113679",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-20T16:21:23.456923Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-20T16:21:50.578Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/harfbuzz/harfbuzz",
          "product": "harfbuzz",
          "repo": "https://github.com/harfbuzz/harfbuzz",
          "vendor": "harfbuzz",
          "versions": [
            {
              "lessThanOrEqual": "14.6.0",
              "status": "affected",
              "version": "8.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:harfbuzz_project:harfbuzz:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "14.6.0",
                  "versionStartIncluding": "8.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Aziz Elbelaychy (Ostorlab)"
        }
      ],
      "datePublic": "2026-10-19T21:41:19.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "HarfBuzz 8.0.0 through 14.6.0 contains an out-of-bounds write vulnerability in the experimental WebAssembly shaper because the font_glyph_to_string import has a wrong WAMR signature. Attackers can supply a crafted font whose wasm module places the output buffer near linear memory\u0027s end, writing glyph-name bytes into host memory to crash or corrupt applications."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "LOCAL",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-787",
              "description": "Out-of-bounds Write",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-20T15:40:40.379Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "patch",
            "issue-tracking"
          ],
          "url": "https://github.com/harfbuzz/harfbuzz/pull/6414"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/harfbuzz/harfbuzz/commit/5e821de8256d01780566b5c8ab7886fae4c93da8"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/harfbuzz/harfbuzz/blob/14.6.0/src/hb-wasm-api-list.hh#L85"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/harfbuzz/harfbuzz/blob/14.6.0/src/hb-wasm-api-font.hh#L115-L123"
        },
        {
          "name": "VulnCheck Advisory: HarfBuzz 8.0.0 through 14.6.0 Out-of-Bounds Write via WebAssembly font_glyph_to_string",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/harfbuzz-8.0.0-through-14.6.0-out-of-bounds-write-via-webassembly-font-glyph-to-string"
        }
      ],
      "title": "HarfBuzz 8.0.0 through 14.6.0 Out-of-Bounds Write via WebAssembly font_glyph_to_string",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-113679",
    "datePublished": "2026-10-20T15:40:40.379Z",
    "dateReserved": "2026-10-20T14:50:55.487Z",
    "dateUpdated": "2026-10-20T16:21:50.578Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-22693 (GCVE-0-2026-22693)

Vulnerability from nvd – Published: 2026-01-10 05:53 – Updated: 2026-01-12 16:47

Title

Null Pointer Dereference in SubtableUnicodesCache::create leading to DoS

Summary

HarfBuzz is a text shaping engine. Prior to version 12.3.0, a null pointer dereference vulnerability exists in the SubtableUnicodesCache::create function located in src/hb-ot-cmap-table.hh. The function fails to check if hb_malloc returns NULL before using placement new to construct an object at the returned pointer address. When hb_malloc fails to allocate memory (which can occur in low-memory conditions or when using custom allocators that simulate allocation failures), it returns NULL. The code then attempts to call the constructor on this null pointer using placement new syntax, resulting in undefined behavior and a Segmentation Fault. This issue has been patched in version 12.3.0.

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-01-12 16:46 UTC

CWE

CWE-476 - NULL Pointer Dereference

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7639 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/harfbuzz/harfbuzz/security/adv…	x_refsource_CONFIRM
https://github.com/harfbuzz/harfbuzz/commit/1265f…	x_refsource_MISC
http://www.openwall.com/lists/oss-security/2026/01/11/1
http://www.openwall.com/lists/oss-security/2026/01/12/1

Impacted products

1 product

Vendor	Product	Version
harfbuzz	harfbuzz	Affected: < 12.3.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-01-12T05:10:58.184Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/01/11/1"
          },
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/01/12/1"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-22693",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-12T16:46:05.339668Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-12T16:47:17.715Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "harfbuzz",
          "vendor": "harfbuzz",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 12.3.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "HarfBuzz is a text shaping engine. Prior to version 12.3.0, a null pointer dereference vulnerability exists in the SubtableUnicodesCache::create function located in src/hb-ot-cmap-table.hh. The function fails to check if hb_malloc returns NULL before using placement new to construct an object at the returned pointer address. When hb_malloc fails to allocate memory (which can occur in low-memory conditions or when using custom allocators that simulate allocation failures), it returns NULL. The code then attempts to call the constructor on this null pointer using placement new syntax, resulting in undefined behavior and a Segmentation Fault. This issue has been patched in version 12.3.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-476",
              "description": "CWE-476: NULL Pointer Dereference",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-10T05:53:21.019Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/harfbuzz/harfbuzz/security/advisories/GHSA-xvjr-f2r9-c7ww",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/harfbuzz/harfbuzz/security/advisories/GHSA-xvjr-f2r9-c7ww"
        },
        {
          "name": "https://github.com/harfbuzz/harfbuzz/commit/1265ff8d990284f04d8768f35b0e20ae5f60daae",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/harfbuzz/harfbuzz/commit/1265ff8d990284f04d8768f35b0e20ae5f60daae"
        }
      ],
      "source": {
        "advisory": "GHSA-xvjr-f2r9-c7ww",
        "discovery": "UNKNOWN"
      },
      "title": "Null Pointer Dereference in SubtableUnicodesCache::create leading to DoS"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-22693",
    "datePublished": "2026-01-10T05:53:21.019Z",
    "dateReserved": "2026-01-08T19:23:09.855Z",
    "dateUpdated": "2026-01-12T16:47:17.715Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-56732 (GCVE-0-2024-56732)

Vulnerability from nvd – Published: 2024-12-27 20:01 – Updated: 2024-12-28 16:48

Title

HarfBuzz heap-buffer-overflow on hb_cairo_glyphs_from_buffer

Summary

HarfBuzz is a text shaping engine. Starting with 8.5.0 through 10.0.1, there is a heap-based buffer overflow in the hb_cairo_glyphs_from_buffer function.

Severity

9.3 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-12-28 16:46 UTC

CWE

CWE-122 - Heap-based Buffer Overflow

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7639 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/harfbuzz/harfbuzz/security/adv…	x_refsource_CONFIRM
https://github.com/harfbuzz/harfbuzz/commit/1767f…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
harfbuzz	harfbuzz	Affected: >= 8.5.0, <= 10.0.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-56732",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-12-28T16:46:53.686962Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-12-28T16:48:04.545Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "harfbuzz",
          "vendor": "harfbuzz",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 8.5.0, \u003c= 10.0.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "HarfBuzz is a text shaping engine. Starting with 8.5.0 through 10.0.1, there is a heap-based buffer overflow in the hb_cairo_glyphs_from_buffer function."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-122",
              "description": "CWE-122: Heap-based Buffer Overflow",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-12-27T20:01:50.275Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/harfbuzz/harfbuzz/security/advisories/GHSA-qmp9-xqm5-jh6m",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/harfbuzz/harfbuzz/security/advisories/GHSA-qmp9-xqm5-jh6m"
        },
        {
          "name": "https://github.com/harfbuzz/harfbuzz/commit/1767f99e2e2196c3fcae27db6d8b60098d3f6d26",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/harfbuzz/harfbuzz/commit/1767f99e2e2196c3fcae27db6d8b60098d3f6d26"
        }
      ],
      "source": {
        "advisory": "GHSA-qmp9-xqm5-jh6m",
        "discovery": "UNKNOWN"
      },
      "title": "HarfBuzz heap-buffer-overflow on hb_cairo_glyphs_from_buffer"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-56732",
    "datePublished": "2024-12-27T20:01:50.275Z",
    "dateReserved": "2024-12-27T15:17:18.511Z",
    "dateUpdated": "2024-12-28T16:48:04.545Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2026-113680 (GCVE-0-2026-113680)

Vulnerability from cvelistv5 – Published: 2026-10-20 15:40 – Updated: 2026-10-20 15:40

Title

HarfBuzz 8.0.0 through 14.6.0 WebAssembly Shaper NULL Pointer Dereference DoS

Summary

HarfBuzz from 8.0.0 through 14.6.0 contains a NULL pointer dereference vulnerability in the experimental WebAssembly shaper host imports buffer_set_contents, face_create, and font_set_coords. Attackers can supply a crafted font whose embedded wasm module passes out-of-range addresses with non-zero lengths, crashing any application that shapes text with the font.

Severity

6.8 (Medium)


                        
                          CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

CWE

CWE-476 - NULL Pointer Dereference

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 6614 records in the last 180 days details

References

6 references

URL	Tags
https://github.com/harfbuzz/harfbuzz/pull/6414	patchissue-tracking
https://github.com/harfbuzz/harfbuzz/commit/a71aa…	patch
https://github.com/harfbuzz/harfbuzz/blob/14.6.0/…	technical-description
https://github.com/harfbuzz/harfbuzz/blob/14.6.0/…	technical-description
https://github.com/harfbuzz/harfbuzz/blob/14.6.0/…	technical-description
https://www.vulncheck.com/advisories/harfbuzz-8.0…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
harfbuzz	harfbuzz	Affected: 8.0.0 , ≤ 14.6.0 (semver) cpe:2.3:a:harfbuzz_project:harfbuzz::::::::

Date Public

2026-10-19 21:41

Credits

Aziz Elbelaychy (Ostorlab)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/harfbuzz/harfbuzz",
          "product": "harfbuzz",
          "repo": "https://github.com/harfbuzz/harfbuzz",
          "vendor": "harfbuzz",
          "versions": [
            {
              "lessThanOrEqual": "14.6.0",
              "status": "affected",
              "version": "8.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:harfbuzz_project:harfbuzz:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "14.6.0",
                  "versionStartIncluding": "8.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Aziz Elbelaychy (Ostorlab)"
        }
      ],
      "datePublic": "2026-10-19T21:41:19.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "HarfBuzz from 8.0.0 through 14.6.0 contains a NULL pointer dereference vulnerability in the experimental WebAssembly shaper host imports buffer_set_contents, face_create, and font_set_coords. Attackers can supply a crafted font whose embedded wasm module passes out-of-range addresses with non-zero lengths, crashing any application that shapes text with the font."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-476",
              "description": "NULL Pointer Dereference",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-20T15:40:41.101Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "patch",
            "issue-tracking"
          ],
          "url": "https://github.com/harfbuzz/harfbuzz/pull/6414"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/harfbuzz/harfbuzz/commit/a71aa86c2bac114fafb6b47f8da02024ecb44fa6"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/harfbuzz/harfbuzz/blob/14.6.0/src/hb-wasm-api-buffer.hh#L153-L181"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/harfbuzz/harfbuzz/blob/14.6.0/src/hb-wasm-api-face.hh#L34-L49"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/harfbuzz/harfbuzz/blob/14.6.0/src/hb-wasm-api-font.hh#L241-L258"
        },
        {
          "name": "VulnCheck Advisory: HarfBuzz 8.0.0 through 14.6.0 WebAssembly Shaper NULL Pointer Dereference DoS",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/harfbuzz-8.0.0-through-14.6.0-webassembly-shaper-null-pointer-dereference-dos"
        }
      ],
      "title": "HarfBuzz 8.0.0 through 14.6.0 WebAssembly Shaper NULL Pointer Dereference DoS",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-113680",
    "datePublished": "2026-10-20T15:40:41.101Z",
    "dateReserved": "2026-10-20T14:51:02.127Z",
    "dateUpdated": "2026-10-20T15:40:41.101Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-113679 (GCVE-0-2026-113679)

Vulnerability from cvelistv5 – Published: 2026-10-20 15:40 – Updated: 2026-10-20 16:21

Title

HarfBuzz 8.0.0 through 14.6.0 Out-of-Bounds Write via WebAssembly font_glyph_to_string

Summary

HarfBuzz 8.0.0 through 14.6.0 contains an out-of-bounds write vulnerability in the experimental WebAssembly shaper because the font_glyph_to_string import has a wrong WAMR signature. Attackers can supply a crafted font whose wasm module places the output buffer near linear memory's end, writing glyph-name bytes into host memory to crash or corrupt applications.

Severity

7.3 (High)


                        
                          CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

7 (High)


                        
                          CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-20 16:21 UTC

CWE

CWE-787 - Out-of-bounds Write

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 6614 records in the last 180 days details

References

5 references

URL	Tags
https://github.com/harfbuzz/harfbuzz/pull/6414	patchissue-tracking
https://github.com/harfbuzz/harfbuzz/commit/5e821…	patch
https://github.com/harfbuzz/harfbuzz/blob/14.6.0/…	technical-description
https://github.com/harfbuzz/harfbuzz/blob/14.6.0/…	technical-description
https://www.vulncheck.com/advisories/harfbuzz-8.0…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
harfbuzz	harfbuzz	Affected: 8.0.0 , ≤ 14.6.0 (semver) cpe:2.3:a:harfbuzz_project:harfbuzz::::::::

Date Public

2026-10-19 21:41

Credits

Aziz Elbelaychy (Ostorlab)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-113679",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-20T16:21:23.456923Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-20T16:21:50.578Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/harfbuzz/harfbuzz",
          "product": "harfbuzz",
          "repo": "https://github.com/harfbuzz/harfbuzz",
          "vendor": "harfbuzz",
          "versions": [
            {
              "lessThanOrEqual": "14.6.0",
              "status": "affected",
              "version": "8.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:harfbuzz_project:harfbuzz:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "14.6.0",
                  "versionStartIncluding": "8.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Aziz Elbelaychy (Ostorlab)"
        }
      ],
      "datePublic": "2026-10-19T21:41:19.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "HarfBuzz 8.0.0 through 14.6.0 contains an out-of-bounds write vulnerability in the experimental WebAssembly shaper because the font_glyph_to_string import has a wrong WAMR signature. Attackers can supply a crafted font whose wasm module places the output buffer near linear memory\u0027s end, writing glyph-name bytes into host memory to crash or corrupt applications."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "LOCAL",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-787",
              "description": "Out-of-bounds Write",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-20T15:40:40.379Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "patch",
            "issue-tracking"
          ],
          "url": "https://github.com/harfbuzz/harfbuzz/pull/6414"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/harfbuzz/harfbuzz/commit/5e821de8256d01780566b5c8ab7886fae4c93da8"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/harfbuzz/harfbuzz/blob/14.6.0/src/hb-wasm-api-list.hh#L85"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/harfbuzz/harfbuzz/blob/14.6.0/src/hb-wasm-api-font.hh#L115-L123"
        },
        {
          "name": "VulnCheck Advisory: HarfBuzz 8.0.0 through 14.6.0 Out-of-Bounds Write via WebAssembly font_glyph_to_string",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/harfbuzz-8.0.0-through-14.6.0-out-of-bounds-write-via-webassembly-font-glyph-to-string"
        }
      ],
      "title": "HarfBuzz 8.0.0 through 14.6.0 Out-of-Bounds Write via WebAssembly font_glyph_to_string",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-113679",
    "datePublished": "2026-10-20T15:40:40.379Z",
    "dateReserved": "2026-10-20T14:50:55.487Z",
    "dateUpdated": "2026-10-20T16:21:50.578Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-22693 (GCVE-0-2026-22693)

Vulnerability from cvelistv5 – Published: 2026-01-10 05:53 – Updated: 2026-01-12 16:47

Title

Null Pointer Dereference in SubtableUnicodesCache::create leading to DoS

Summary

HarfBuzz is a text shaping engine. Prior to version 12.3.0, a null pointer dereference vulnerability exists in the SubtableUnicodesCache::create function located in src/hb-ot-cmap-table.hh. The function fails to check if hb_malloc returns NULL before using placement new to construct an object at the returned pointer address. When hb_malloc fails to allocate memory (which can occur in low-memory conditions or when using custom allocators that simulate allocation failures), it returns NULL. The code then attempts to call the constructor on this null pointer using placement new syntax, resulting in undefined behavior and a Segmentation Fault. This issue has been patched in version 12.3.0.

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-01-12 16:46 UTC

CWE

CWE-476 - NULL Pointer Dereference

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7639 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/harfbuzz/harfbuzz/security/adv…	x_refsource_CONFIRM
https://github.com/harfbuzz/harfbuzz/commit/1265f…	x_refsource_MISC
http://www.openwall.com/lists/oss-security/2026/01/11/1
http://www.openwall.com/lists/oss-security/2026/01/12/1

Impacted products

1 product

Vendor	Product	Version
harfbuzz	harfbuzz	Affected: < 12.3.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-01-12T05:10:58.184Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/01/11/1"
          },
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/01/12/1"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-22693",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-12T16:46:05.339668Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-12T16:47:17.715Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "harfbuzz",
          "vendor": "harfbuzz",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 12.3.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "HarfBuzz is a text shaping engine. Prior to version 12.3.0, a null pointer dereference vulnerability exists in the SubtableUnicodesCache::create function located in src/hb-ot-cmap-table.hh. The function fails to check if hb_malloc returns NULL before using placement new to construct an object at the returned pointer address. When hb_malloc fails to allocate memory (which can occur in low-memory conditions or when using custom allocators that simulate allocation failures), it returns NULL. The code then attempts to call the constructor on this null pointer using placement new syntax, resulting in undefined behavior and a Segmentation Fault. This issue has been patched in version 12.3.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-476",
              "description": "CWE-476: NULL Pointer Dereference",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-10T05:53:21.019Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/harfbuzz/harfbuzz/security/advisories/GHSA-xvjr-f2r9-c7ww",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/harfbuzz/harfbuzz/security/advisories/GHSA-xvjr-f2r9-c7ww"
        },
        {
          "name": "https://github.com/harfbuzz/harfbuzz/commit/1265ff8d990284f04d8768f35b0e20ae5f60daae",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/harfbuzz/harfbuzz/commit/1265ff8d990284f04d8768f35b0e20ae5f60daae"
        }
      ],
      "source": {
        "advisory": "GHSA-xvjr-f2r9-c7ww",
        "discovery": "UNKNOWN"
      },
      "title": "Null Pointer Dereference in SubtableUnicodesCache::create leading to DoS"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-22693",
    "datePublished": "2026-01-10T05:53:21.019Z",
    "dateReserved": "2026-01-08T19:23:09.855Z",
    "dateUpdated": "2026-01-12T16:47:17.715Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-56732 (GCVE-0-2024-56732)

Vulnerability from cvelistv5 – Published: 2024-12-27 20:01 – Updated: 2024-12-28 16:48

Title

HarfBuzz heap-buffer-overflow on hb_cairo_glyphs_from_buffer

Summary

HarfBuzz is a text shaping engine. Starting with 8.5.0 through 10.0.1, there is a heap-based buffer overflow in the hb_cairo_glyphs_from_buffer function.

Severity

9.3 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-12-28 16:46 UTC

CWE

CWE-122 - Heap-based Buffer Overflow

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7639 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/harfbuzz/harfbuzz/security/adv…	x_refsource_CONFIRM
https://github.com/harfbuzz/harfbuzz/commit/1767f…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
harfbuzz	harfbuzz	Affected: >= 8.5.0, <= 10.0.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-56732",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-12-28T16:46:53.686962Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-12-28T16:48:04.545Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "harfbuzz",
          "vendor": "harfbuzz",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 8.5.0, \u003c= 10.0.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "HarfBuzz is a text shaping engine. Starting with 8.5.0 through 10.0.1, there is a heap-based buffer overflow in the hb_cairo_glyphs_from_buffer function."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-122",
              "description": "CWE-122: Heap-based Buffer Overflow",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-12-27T20:01:50.275Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/harfbuzz/harfbuzz/security/advisories/GHSA-qmp9-xqm5-jh6m",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/harfbuzz/harfbuzz/security/advisories/GHSA-qmp9-xqm5-jh6m"
        },
        {
          "name": "https://github.com/harfbuzz/harfbuzz/commit/1767f99e2e2196c3fcae27db6d8b60098d3f6d26",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/harfbuzz/harfbuzz/commit/1767f99e2e2196c3fcae27db6d8b60098d3f6d26"
        }
      ],
      "source": {
        "advisory": "GHSA-qmp9-xqm5-jh6m",
        "discovery": "UNKNOWN"
      },
      "title": "HarfBuzz heap-buffer-overflow on hb_cairo_glyphs_from_buffer"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-56732",
    "datePublished": "2024-12-27T20:01:50.275Z",
    "dateReserved": "2024-12-27T15:17:18.511Z",
    "dateUpdated": "2024-12-28T16:48:04.545Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Find a vulnerability

Search criteria

8 vulnerabilities by harfbuzz

CVE-2026-113680 (GCVE-0-2026-113680)

CVE-2026-113679 (GCVE-0-2026-113679)

CVE-2026-22693 (GCVE-0-2026-22693)

CVE-2024-56732 (GCVE-0-2024-56732)

CVE-2026-113680 (GCVE-0-2026-113680)

CVE-2026-113679 (GCVE-0-2026-113679)

CVE-2026-22693 (GCVE-0-2026-22693)

CVE-2024-56732 (GCVE-0-2024-56732)