Harfbuzz vulnerabilities

CVE-2024-56732 [HIGH] CWE-122 CVE-2024-56732: HarfBuzz is a text shaping engine. Starting with 8.5.0 through 10.0.1, there is a heap-based buffer HarfBuzz is a text shaping engine. Starting with 8.5.0 through 10.0.1, there is a heap-based buffer overflow in the hb_cairo_glyphs_from_buffer function.

CVE-2026-113679 [HIGH] CWE-787 CVE-2026-113679: HarfBuzz 8.0.0 through 14.6.0 contains an out-of-bounds write vulnerability in the experimental WebA HarfBuzz 8.0.0 through 14.6.0 contains an out-of-bounds write vulnerability in the experimental WebAssembly shaper because the font_glyph_to_string import has a wrong WAMR signature. Attackers can supply a crafted font whose wasm module places the output buffer near linear memory's end, writing glyph-name bytes into host memory to crash or corrupt a

CVE-2026-22693 [MEDIUM] CWE-476 CVE-2026-22693: HarfBuzz is a text shaping engine. Prior to version 12.3.0, a null pointer dereference vulnerability HarfBuzz is a text shaping engine. Prior to version 12.3.0, a null pointer dereference vulnerability exists in the SubtableUnicodesCache::create function located in src/hb-ot-cmap-table.hh. The function fails to check if hb_malloc returns NULL before using placement new to construct an object at the returned pointer address. When hb_malloc fails to

CVE-2026-113680 [MEDIUM] CWE-476 CVE-2026-113680: HarfBuzz from 8.0.0 through 14.6.0 contains a NULL pointer dereference vulnerability in the experime HarfBuzz from 8.0.0 through 14.6.0 contains a NULL pointer dereference vulnerability in the experimental WebAssembly shaper host imports buffer_set_contents, face_create, and font_set_coords. Attackers can supply a crafted font whose embedded wasm module passes out-of-range addresses with non-zero lengths, crashing any application that shapes text