CVE-2026-22693

Name	CVE-2026-22693
Description	HarfBuzz is a text shaping engine. Prior to version 12.3.0, a null pointer dereference vulnerability exists in the SubtableUnicodesCache::create function located in src/hb-ot-cmap-table.hh. The function fails to check if hb_malloc returns NULL before using placement new to construct an object at the returned pointer address. When hb_malloc fails to allocate memory (which can occur in low-memory conditions or when using custom allocators that simulate allocation failures), it returns NULL. The code then attempts to call the constructor on this null pointer using placement new syntax, resulting in undefined behavior and a Segmentation Fault. This issue has been patched in version 12.3.0.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1125189

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
harfbuzz (PTS)	bullseye	2.7.4-1	vulnerable
	bookworm	6.0.0+dfsg-3	vulnerable
	trixie	10.2.0-1	vulnerable
	forky	12.3.0-4	fixed
	sid	12.3.2-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
harfbuzz	source	(unstable)	12.3.0-4			1125189

Notes

[trixie] - harfbuzz <no-dsa> (Minor issue)
[bookworm] - harfbuzz <no-dsa> (Minor issue)
[bullseye] - harfbuzz <postponed> (Minor issue)
https://github.com/harfbuzz/harfbuzz/security/advisories/GHSA-xvjr-f2r9-c7ww
Fixed by: https://github.com/harfbuzz/harfbuzz/commit/1265ff8d990284f04d8768f35b0e20ae5f60daae