Read the docs
TI-2026-18220 Aliases CVE-2026-22693

Null Pointer Dereference in SubtableUnicodesCache::create leading to DoS

Priority LOW 30CWE-476Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · Low
Fix status
Partial Red Hat: 1 fixed, 8 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-476.

Summary

HarfBuzz is a text shaping engine. Prior to version 12.3.0, a null pointer dereference vulnerability exists in the SubtableUnicodesCache::create function located in src/hb-ot-cmap-table.hh. The function fails to check if hb_malloc returns NULL before using placement new to construct an object at the returned pointer address. When hb_malloc fails to allocate memory (which can occur in low-memory conditions or when using custom allocators that simulate allocation failures), it returns NULL. The code then attempts to call the constructor on this null pointer using placement new syntax, resulting in undefined behavior and a Segmentation Fault. This issue has been patched in version 12.3.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00452 39th percentileScored 2026-11-07
Public exploit Yes 3 exploit referencesTagged by NVD
Fix Partial harfbuzz (harfbuzz): 12.3.0Red Hat: 1 advisoryRed Hat: 1 fixed, 8 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
harfbuzzharfbuzzbefore 12.3.012.3.0Patch availableCNA
  • harfbuzz Vendorharfbuzz Affected before 12.3.0 Fixed in 12.3.0 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:harfbuzz_project:harfbuzz:*:*:*:*:*:*:*:*before 12.3.0VulnerableHarfbuzz Project
  • cpe:2.3:a:harfbuzz_project:harfbuzz:*:*:*:*:*:*:*:* Versions before 12.3.0 Vulnerable ·Harfbuzz Project

Remediation

  • Fix · CNA harfbuzz (harfbuzz) Fixed in 12.3.0

Red Hat 1 advisory

  • RHSA-2026:7701 Released 2026-04-13 · Red Hat rating Moderate
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images harfbuzz-14.1.0-2.hum1@aarch64, harfbuzz-14.1.0-2.hum1@src, harfbuzz-14.1.0-2.hum1@x86_64 +12

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 10AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 7AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 8AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 9AffectedNo fix yet: Fix deferred
Red Hat build of OpenJDK 11 ELSAffectedNo fix yet: Fix deferred
Red Hat build of OpenJDK 17AffectedNo fix yet: Fix deferred
Red Hat build of OpenJDK 21AffectedNo fix yet: Fix deferred
Red Hat build of OpenJDK 25AffectedNo fix yet: Fix deferred
Red Hat Hardened ImagesFixed RHSA-2026:7701

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-22693

References

Exploit 3

Patch 1

  • TI-2026-76946 Out-of-bounds write in HarfBuzz WebAssembly font shaper CVSS 4.0HIGH 7.3
  • TI-2026-76947 NULL pointer dereference in HarfBuzz WebAssembly shaper crashes apps CVSS 4.0MEDIUM 6.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences