PT-2026-2246 · Harfbuzz+1 · Harfbuzz+1

Jungwoojjing · Published 2026-01-01 · Updated 2026-03-20 · CVE-2026-22693

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions HarfBuzz versions prior to 12.3.0

Description HarfBuzz is a text shaping engine. A null pointer dereference issue exists in the SubtableUnicodesCache::create function, located in src/hb-ot-cmap-table.hh. The function does not verify if hb malloc returns NULL before attempting to construct an object at the returned pointer address. If hb malloc fails to allocate memory, it returns NULL, and the code then attempts to call the constructor on this null pointer, leading to undefined behavior and a Segmentation Fault. This issue was detected through simulated memory allocation failures in a fuzzing environment.

Recommendations Update to HarfBuzz version 12.3.0 or later.

Exploit

Fix

DoS

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

AZL-73970

BDU:2026-06703

CVE-2026-22693

ECHO-7ECB-7A01-33A3

GHSA-XVJR-F2R9-C7WW

MGASA-2026-0015

OESA-2026-1203

OESA-2026-1204

OPENSUSE-SU-2026:10065-1

OPENSUSE-SU-2026:20409-1

RHSA-2026:7701

SUSE-SU-2026:0287-1

SUSE-SU-2026:20762-1

SUSE-SU-2026:20922-1

Affected Products

Debian

Harfbuzz

References · 49

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22693.json · Exploit
• https://github.com/harfbuzz/harfbuzz/commit/1265ff8d990284f04d8768f35b0e20ae5f60daae · Patch
• https://github.com/harfbuzz/harfbuzz/security/advisories/GHSA-xvjr-f2r9-c7ww · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-22693 · Vendor Advisory
• http://openwall.com/lists/oss-security/2026/01/11/1 · Patch
• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-12-CVE-2026-22693 · Vendor Advisory
• http://openwall.com/lists/oss-security/2026/01/12/1 · Patch
• https://osv.dev/vulnerability/CVE-2026-22693 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:20409-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:20922-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-06703 · Security Note
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2026-0518SE47 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10065-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-22693 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:0287-1 · Vendor Advisory