CVE-2026-22693 Null Pointer Dereference in SubtableUnicodesCache::create leading to DoS
A null pointer dereference in HarfBuzz allows attackers to cause a denial of service via memory allocation failures.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-22693?
CVE-2026-22693 is a medium-severity vulnerability in harfbuzz, published on 10 Jan 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
HarfBuzz is a text shaping engine. Prior to version 12.3.0, a null pointer dereference vulnerability exists in the SubtableUnicodesCache::create function located in src/hb-ot-cmap-table.hh. The function fails to check if hb_malloc returns NULL before using placement new to construct an object at the returned pointer address. When hb_malloc fails to allocate memory (which can occur in low-memory conditions or when using custom allocators that simulate allocation failures), it returns NULL. The code then attempts to call the constructor on this null pointer using placement new syntax, resulting in undefined behavior and a Segmentation Fault. This issue has been patched in version 12.3.0.
Weakness: CWE-476
Which versions are affected by CVE-2026-22693?
It affects 1 product.
Linux distribution packages (14)
harfbuzz Red Hat:hummingbird:1 | All versions | 0:14.1.0-2.hum1 |
harfbuzz-cairo Red Hat:hummingbird:1 | All versions | 0:14.1.0-2.hum1 |
harfbuzz-devel Red Hat:hummingbird:1 | All versions | 0:14.1.0-2.hum1 |
harfbuzz-gpu Red Hat:hummingbird:1 | All versions | 0:14.1.0-2.hum1 |
harfbuzz-icu Red Hat:hummingbird:1 | All versions | 0:14.1.0-2.hum1 |
harfbuzz-raster Red Hat:hummingbird:1 | All versions | 0:14.1.0-2.hum1 |
harfbuzz-vector Red Hat:hummingbird:1 | All versions | 0:14.1.0-2.hum1 |
harfbuzz SUSE:Linux Enterprise Module for Basesystem 15 SP7 | All versions | 8.3.0-150600.3.3.1 |
harfbuzz SUSE:Linux Enterprise Server 16.0 | All versions | 11.4.5-160000.1.1 |
harfbuzz SUSE:Linux Enterprise Server for SAP applications 16.0 | All versions | 11.4.5-160000.1.1 |
harfbuzz SUSE:Linux Micro 6.2 | All versions | 11.4.5-160000.1.1 |
harfbuzz openSUSE:Leap 15.6 | All versions | 8.3.0-150600.3.3.1 |
harfbuzz openSUSE:Leap 16.0 | All versions | 11.4.5-160000.1.1 |
harfbuzz openSUSE:Tumbleweed | All versions | 12.3.0-2.1 |
Products include Harfbuzz Project Harfbuzz.
How do I fix CVE-2026-22693?
Upgrade to a fixed version.
Is CVE-2026-22693 being exploited?
There is no known exploitation of CVE-2026-22693 in the wild and no public exploit code.
Other vulnerabilities in harfbuzz
Sources
Also known as AZL-73970, DEBIAN-CVE-2026-22693, ECHO-7ecb-7a01-33a3, GHSA-xvjr-f2r9-c7ww, JLSEC-2026-777, MGASA-2026-0015 and 13 more.