CVE-2026-22693
Null Pointer Dereference in HarfBuzz Causes Potential Crash
Publication date: 2026-01-10
Last updated on: 2026-02-18
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| harfbuzz_project | harfbuzz | to 12.3.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-476 | The product dereferences a pointer that it expects to be valid but is NULL. |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability impact me? :
This vulnerability can lead to a Denial of Service (DoS) condition. When the null pointer dereference occurs, it causes a segmentation fault that crashes the application using HarfBuzz, potentially disrupting font processing and any dependent services or applications. [2]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring for segmentation faults or crashes in applications using HarfBuzz, especially those related to font processing. Using AddressSanitizer (ASAN) with fuzzing enabled can reproduce the issue by simulating memory allocation failures. A proof-of-concept is available in the HarfBuzz fuzzing tests (test/fuzzing/repro.cc). Specific commands would involve running the vulnerable application under ASAN with fuzzing enabled to trigger the null pointer dereference. For example, compiling the application with ASAN and running the fuzzing tests can help detect the vulnerability. [2]
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to upgrade HarfBuzz to version 12.3.0 or later, where the vulnerability has been patched by adding a null check after memory allocation in the SubtableUnicodesCache::create function. If upgrading is not immediately possible, monitoring for crashes and avoiding low-memory conditions or custom allocators that simulate allocation failures may reduce the risk. Applying the patch from the commit identified by SHA 1265ff8 (https://github.com/harfbuzz/harfbuzz/commit/1265ff8d990284f04d8768f35b0e20ae5f60daae) is also a direct fix. [1]
Can you explain this vulnerability to me?
CVE-2026-22693 is a null pointer dereference vulnerability in the HarfBuzz text shaping engine, specifically in the SubtableUnicodesCache::create function. The function allocates memory using hb_malloc but does not check if the allocation returned NULL before using placement new to construct an object at that memory address. If hb_malloc fails (e.g., due to low memory), it returns NULL, and the code then attempts to construct an object at this null pointer, causing undefined behavior and a segmentation fault. [2]