Every CVE Search/ Get API key

CVE-2024-56732

HarfBuzz heap-buffer-overflow on hb_cairo_glyphs_from_buffer

9.3 CriticalFix available

HarfBuzz is a text shaping engine. Starting with 8.5.0 through 10.0.1, there is a heap-based buffer overflow in the hb_cairo_glyphs_from_buffer function.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

0.65%Up 0.6 points since Dec 28, 2024
90%50%10%1%

What each source reports

CVE List Score used 9.3

HarfBuzz heap-buffer-overflow on hb_cairo_glyphs_from_buffer

HarfBuzz is a text shaping engine. Starting with 8.5.0 through 10.0.1, there is a heap-based buffer overflow in the hb_cairo_glyphs_from_buffer function.

Record
CVE-2024-56732
CVSS 4.0
9.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-122
Updated
2026-11-02
EUVDEUVD-2024-53379 9.3

HarfBuzz is a text shaping engine. Starting with 8.5.0 through 10.0.1, there is a heap-based buffer overflow in the hb_cairo_glyphs_from_buffer function.

Record
EUVD-2024-53379
CVSS 4.0
9.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Updated
2026-11-03
NVD 9.3

HarfBuzz is a text shaping engine. Starting with 8.5.0 through 10.0.1, there is a heap-based buffer overflow in the hb_cairo_glyphs_from_buffer function.

Record
CVE-2024-56732
CVSS 4.0
9.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-122
Updated
2026-11-02
OSVBELL-CVE-2024-56732 8.8
Record
BELL-CVE-2024-56732
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSV 9.3

HarfBuzz heap-buffer-overflow on hb_cairo_glyphs_from_buffer

HarfBuzz is a text shaping engine. Starting with 8.5.0 through 10.0.1, there is a heap-based buffer overflow in the hb_cairo_glyphs_from_buffer function.

Record
CVE-2024-56732
CVSS 4.0
9.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-122
Updated
2026-11-02
OSVDEBIAN-CVE-2024-56732 9.3

HarfBuzz is a text shaping engine. Starting with 8.5.0 through 10.0.1, there is a heap-based buffer overflow in the hb_cairo_glyphs_from_buffer function.

Record
DEBIAN-CVE-2024-56732
CVSS 4.0
9.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
Show 7 moreShow less
OSVJLSEC-2026-776 9.3

HarfBuzz is a text shaping engine. Starting with 8.5.0 through 10.0.1, there is a heap-based buffer overflow in the hb_cairo_glyphs_from_buffer function.

Record
JLSEC-2026-776
CVSS 4.0
9.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVOESA-2025-1009 8.8

harfbuzz security update

HarfBuzz is a text-shaping engine. If you give HarfBuzz a font and a string containing a sequence of Unicode codepoints, HarfBuzz selects and positions the corresponding glyphs from the font, applying all of the necessary layout rules and font features. HarfBuzz then returns the string to you in the form that is correctly arranged for the language and writing system.

Security Fix(es):

HarfBuzz is a text shaping engine. Starting with 8.5.0 through 10.0.1, there is a heap-based buffer overflow in the hb_cairo_glyphs_from_buffer function.(CVE-2024-56732)

Record
OESA-2025-1009
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVOESA-2025-1019 8.8

harfbuzz security update

HarfBuzz is a text-shaping engine. If you give HarfBuzz a font and a string containing a sequence of Unicode codepoints, HarfBuzz selects and positions the corresponding glyphs from the font, applying all of the necessary layout rules and font features. HarfBuzz then returns the string to you in the form that is correctly arranged for the language and writing system.

Security Fix(es):

HarfBuzz is a text shaping engine. Starting with 8.5.0 through 10.0.1, there is a heap-based buffer overflow in the hb_cairo_glyphs_from_buffer function.(CVE-2024-56732)

Record
OESA-2025-1019
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2024-56732 9.3

HarfBuzz is a text shaping engine. Starting with 8.5.0 through 10.0.1, there is a heap-based buffer overflow in the hb_cairo_glyphs_from_buffer function.

Record
UBUNTU-CVE-2024-56732
CVSS 4.0
9.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVAZL-54701 No score

CVE-2024-56732 affecting package qtbase for versions less than 6.6.3-2

HarfBuzz is a text shaping engine. Starting with 8.5.0 through 10.0.1, there is a heap-based buffer overflow in the hb_cairo_glyphs_from_buffer function.

Record
AZL-54701
Updated
2026-11-05
OSVAZL-54704 No score

CVE-2024-56732 affecting package harfbuzz for versions less than 8.3.0-3

HarfBuzz is a text shaping engine. Starting with 8.5.0 through 10.0.1, there is a heap-based buffer overflow in the hb_cairo_glyphs_from_buffer function.

Record
AZL-54704
Updated
2026-11-05
OSVopenSUSE-SU-2025:14614-1 No score

harfbuzz-devel-10.1.0-2.1 on GA media

These are all security issues fixed in the harfbuzz-devel-10.1.0-2.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2025:14614-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
qtbase
Azure Linux:3
 before 6.6.3-2
6.6.3-2
harfbuzz
Azure Linux:3
 before 8.3.0-3
8.3.0-3
harfbuzz
Alpaquita:stream
 8.5.0-r0 up to 10.1.0-r0
10.1.0-r0
harfbuzz
Debian:13
 before 10.1.0-2
10.1.0-2
harfbuzz
Debian:14
 before 10.1.0-2
10.1.0-2
HarfBuzz_ICU_jll
Julia
 8.5.0+0 up to 100.14002.1+0
100.14002.1+0
HarfBuzz_jll
Julia
 8.5.0+0 up to 100.14002.1+0
100.14002.1+0
harfbuzz
openEuler:24.03-LTS
 before 8.3.0-2.oe2403
8.3.0-2.oe2403
harfbuzz
openEuler:24.03-LTS-SP1
 before 8.3.0-2.oe2403sp1
8.3.0-2.oe2403sp1
harfbuzz
Ubuntu:14.04:LTS
 All versions, plus listed versions
0.9.19-10.9.19-1ubuntu10.9.24-2ubuntu10.9.24-2ubuntu20.9.24-2ubuntu3
Show 6 moreShow less
0.9.25-1ubuntu10.9.26-30.9.26-40.9.27-10.9.27-1ubuntu10.9.27-1ubuntu1.1
 None known
Show 5 moreShow less
Affected packages
PackageAffectedFixed
harfbuzz
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
1.0.1-1build21.0.1-1ubuntu0.11.0.1-1ubuntu0.1+esm1
 None known
harfbuzz
Ubuntu:18.04:LTS
 All versions, plus listed versions
1.4.2-11.4.2-1build11.6.3-1build11.7.1-11.7.2-11.7.2-1ubuntu1
 None known
harfbuzz
Ubuntu:25.10
 before 10.2.0-1
10.2.0-1
harfbuzz
Ubuntu:26.04:LTS
 before 10.2.0-1
10.2.0-1
harfbuzz
openSUSE:Tumbleweed
 before 10.1.0-2.1
10.1.0-2.1

History

History
RecordedChangedSources
factsOSV
aliases, publishedEUVD
first indexedCVE List, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-56732 is a critical vulnerability (CVSS 9.3) in Harfbuzz, published December 27, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.65%, the 51st percentile. Fixed in qtbase 6.6.3-2.

References

Show 6 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open