Vulnerabilities

TI-2026-18220 CVE-2026-22693

Null Pointer Dereference in SubtableUnicodesCache::create leading to DoS

LOW 30

HarfBuzz is a text shaping engine.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00452 Published 2026-01-10 Partial fix · 12.3.0 CWE-476

TI-2024-37616 CVE-2024-56732

HarfBuzz heap-buffer-overflow on hb_cairo_glyphs_from_buffer

HIGH 75

HarfBuzz is a text shaping engine.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00652 Published 2024-12-27 No fix listed CWE-122

TI-2023-10653 CVE-2023-25193 · GHSA-v8ff-vmc3-wr4m

hb-ot-layout-gsubgpos.hh in HarfBuzz through 6.0.0 allows attackers to trigger O(n^2)…

MEDIUM 42

hb-ot-layout-gsubgpos.hh in HarfBuzz through 6.0.0 allows attackers to trigger O(n^2) growth via consecutive marks during the process of looking back for base glyphs when attaching marks.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01812 Published 2023-02-04 Partial fix CWE-770

TI-2022-14547 CVE-2022-33068 · GHSA-cq67-chj5-8385

An integer overflow in the component hb-ot-shape-fallback.cc of Harfbuzz v4.3.0 allows…

LOW 27

An integer overflow in the component hb-ot-shape-fallback.cc of Harfbuzz v4.3.0 allows attackers to cause a Denial of Service (DoS) via unspecified vectors.

CVSS 3.1MEDIUM 5.5 Local No auth User interaction EPSS 0.01189 Published 2022-06-22 Fixed CWE-190

TI-2021-20935 CVE-2021-45931 · GHSA-77w9-6m5g-vpj2

HarfBuzz 2.9.0 has an out-of-bounds write in hb_bit_set_invertible_t::set (called from…

LOW 33

HarfBuzz 2.9.0 has an out-of-bounds write in hb_bit_set_invertible_t::set (called from hb_sparseset_t<hb_bit_set_invertible_t>::set and hb_set_copy).

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.01839 Published 2021-12-31 No fix listed CWE-787

TI-2015-07652 CVE-2015-9274 · GHSA-95rc-6f28-2jcq

HarfBuzz before 1.0.4 allows remote attackers to cause a denial of service (invalid read…

LOW 32

HarfBuzz before 1.0.4 allows remote attackers to cause a denial of service (invalid read of two bytes and application crash) because of GPOS and GSUB table mishandling, related to hb-ot-layout-gpos-table.hh, hb-ot-layout…

CVSS 3.0MEDIUM 6.5 Network No auth User interaction EPSS 0.01555 Published 2018-11-15 Will not fix CWE-125

TI-2015-07360 CVE-2015-8947 · GHSA-8w8v-wf57-7pwq

hb-ot-layout-gpos-table.hh in HarfBuzz before 1.0.5 allows remote attackers to cause a…

LOW 38

hb-ot-layout-gpos-table.hh in HarfBuzz before 1.0.5 allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via crafted data, a different vulnerability than CVE-2…

CVSS 3.0HIGH 7.6 Network No auth User interaction EPSS 0.02551 Published 2016-07-19 Partial fix CWE-119

TI-2016-01883 CVE-2016-2052 · GHSA-vx72-qhm5-54jj

Multiple unspecified vulnerabilities in HarfBuzz before 1.0.6, as used in Google Chrome…

LOW 35

Multiple unspecified vulnerabilities in HarfBuzz before 1.0.6, as used in Google Chrome before 48.0.2564.82, allow attackers to cause a denial of service or possibly have other impact via crafted data, as demonstrated by…

CVSS 3.0HIGH 7.6 Network No auth User interaction EPSS 0.00959 Published 2016-01-25 Partial fix

Vulnerabilities

Filters