Priority HIGH 75
HarfBuzz is a text shaping engine.
Harfbuzz Project
Records8All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high3CVSS 7.0–8.9
Exploited now
Harfbuzz Project records in CISA KEVNo Harfbuzz Project vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
8 records
TI-2023-10653 CVE-2023-25193 · GHSA-v8ff-vmc3-wr4m
hb-ot-layout-gsubgpos.hh in HarfBuzz through 6.0.0 allows attackers to trigger O(n^2)…
Priority MEDIUM 42
hb-ot-layout-gsubgpos.hh in HarfBuzz through 6.0.0 allows attackers to trigger O(n^2) growth via consecutive marks during the process of looking back for base glyphs when attaching marks.
TI-2015-07360 CVE-2015-8947 · GHSA-8w8v-wf57-7pwq
hb-ot-layout-gpos-table.hh in HarfBuzz before 1.0.5 allows remote attackers to cause a…
Priority LOW 38
hb-ot-layout-gpos-table.hh in HarfBuzz before 1.0.5 allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via crafted data, a different vulnerability than CVE-2…
TI-2016-01883 CVE-2016-2052 · GHSA-vx72-qhm5-54jj
Multiple unspecified vulnerabilities in HarfBuzz before 1.0.6, as used in Google Chrome…
Priority LOW 35
Multiple unspecified vulnerabilities in HarfBuzz before 1.0.6, as used in Google Chrome before 48.0.2564.82, allow attackers to cause a denial of service or possibly have other impact via crafted data, as demonstrated by…
TI-2021-20935 CVE-2021-45931 · GHSA-77w9-6m5g-vpj2
HarfBuzz 2.9.0 has an out-of-bounds write in hb_bit_set_invertible_t::set (called from…
Priority LOW 33
HarfBuzz 2.9.0 has an out-of-bounds write in hb_bit_set_invertible_t::set (called from hb_sparseset_t<hb_bit_set_invertible_t>::set and hb_set_copy).
TI-2015-07652 CVE-2015-9274 · GHSA-95rc-6f28-2jcq
HarfBuzz before 1.0.4 allows remote attackers to cause a denial of service (invalid read…
Priority LOW 32
HarfBuzz before 1.0.4 allows remote attackers to cause a denial of service (invalid read of two bytes and application crash) because of GPOS and GSUB table mishandling, related to hb-ot-layout-gpos-table.hh, hb-ot-layout…
TI-2026-18220 CVE-2026-22693
Null Pointer Dereference in SubtableUnicodesCache::create leading to DoS
Priority LOW 30
HarfBuzz is a text shaping engine.
TI-2022-14547 CVE-2022-33068 · GHSA-cq67-chj5-8385
An integer overflow in the component hb-ot-shape-fallback.cc of Harfbuzz v4.3.0 allows…
Priority LOW 27
An integer overflow in the component hb-ot-shape-fallback.cc of Harfbuzz v4.3.0 allows attackers to cause a Denial of Service (DoS) via unspecified vectors.