Every CVE Search/ Get API key

CVE-2026-22693

Null Pointer Dereference in SubtableUnicodesCache::create leading to DoS

5.3 MediumFix available

HarfBuzz is a text shaping engine. Prior to version 12.3.0, a null pointer dereference vulnerability exists in the SubtableUnicodesCache::create function located in src/hb-ot-cmap-table.hh. The function fails to check if hb_malloc returns NULL before using placement new to construct an object at the returned pointer address. When hb_malloc fails to allocate memory (which can occur in low-memory conditions or when using custom allocators that simulate allocation failures), it returns NULL. The code then attempts to call the constructor on this null pointer using placement new syntax, resulting in undefined behavior and a Segmentation Fault. This issue has been patched in version 12.3.0.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
Low

Exploit likelihood

0.45%Up 0.4 points since Jan 10, 2026
90%50%10%1%

What each source reports

CVE List Score used 5.3

Null Pointer Dereference in SubtableUnicodesCache::create leading to DoS

HarfBuzz is a text shaping engine. Prior to version 12.3.0, a null pointer dereference vulnerability exists in the SubtableUnicodesCache::create function located in src/hb-ot-cmap-table.hh. The function fails to check if hb_malloc returns NULL before using placement new to construct an object at the returned pointer address. When hb_malloc fails to allocate memory (which can occur in low-memory conditions or when using custom allocators that simulate allocation failures), it returns NULL. The code then attempts to call the constructor on this null pointer using placement new syntax, resulting in undefined behavior and a Segmentation Fault. This issue has been patched in version 12.3.0.

Record
CVE-2026-22693
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-476
Updated
2026-11-02
EUVDEUVD-2026-1871 5.3

HarfBuzz is a text shaping engine. Prior to version 12.3.0, a null pointer dereference vulnerability exists in the SubtableUnicodesCache::create function located in src/hb-ot-cmap-table.hh. The function fails to check if hb_malloc returns NULL before using placement new to construct an object at the returned pointer address. When hb_malloc fails to allocate memory (which can occur in low-memory conditions or when using custom allocators that simulate allocation failures), it returns NULL. The code then attempts to call the constructor on this null pointer using placement new syntax, resulting in undefined behavior and a Segmentation Fault. This issue has been patched in version 12.3.0.

Record
EUVD-2026-1871
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
NVD 5.3

HarfBuzz is a text shaping engine. Prior to version 12.3.0, a null pointer dereference vulnerability exists in the SubtableUnicodesCache::create function located in src/hb-ot-cmap-table.hh. The function fails to check if hb_malloc returns NULL before using placement new to construct an object at the returned pointer address. When hb_malloc fails to allocate memory (which can occur in low-memory conditions or when using custom allocators that simulate allocation failures), it returns NULL. The code then attempts to call the constructor on this null pointer using placement new syntax, resulting in undefined behavior and a Segmentation Fault. This issue has been patched in version 12.3.0.

Record
CVE-2026-22693
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-476
Updated
2026-11-02
OSV 5.3

Null Pointer Dereference in SubtableUnicodesCache::create leading to DoS

HarfBuzz is a text shaping engine. Prior to version 12.3.0, a null pointer dereference vulnerability exists in the SubtableUnicodesCache::create function located in src/hb-ot-cmap-table.hh. The function fails to check if hb_malloc returns NULL before using placement new to construct an object at the returned pointer address. When hb_malloc fails to allocate memory (which can occur in low-memory conditions or when using custom allocators that simulate allocation failures), it returns NULL. The code then attempts to call the constructor on this null pointer using placement new syntax, resulting in undefined behavior and a Segmentation Fault. This issue has been patched in version 12.3.0.

Record
CVE-2026-22693
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-476
Updated
2026-11-02
OSVDEBIAN-CVE-2026-22693 5.3

HarfBuzz is a text shaping engine. Prior to version 12.3.0, a null pointer dereference vulnerability exists in the SubtableUnicodesCache::create function located in src/hb-ot-cmap-table.hh. The function fails to check if hb_malloc returns NULL before using placement new to construct an object at the returned pointer address. When hb_malloc fails to allocate memory (which can occur in low-memory conditions or when using custom allocators that simulate allocation failures), it returns NULL. The code then attempts to call the constructor on this null pointer using placement new syntax, resulting in undefined behavior and a Segmentation Fault. This issue has been patched in version 12.3.0.

Record
DEBIAN-CVE-2026-22693
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVJLSEC-2026-777 5.3

HarfBuzz is a text shaping engine. Prior to version 12.3.0, a null pointer dereference vulnerability exists in the SubtableUnicodesCache::create function located in src/hb-ot-cmap-table.hh. The function fails to check if hb_malloc returns NULL before using placement new to construct an object at the returned pointer address. When hb_malloc fails to allocate memory (which can occur in low-memory conditions or when using custom allocators that simulate allocation failures), it returns NULL. The code then attempts to call the constructor on this null pointer using placement new syntax, resulting in undefined behavior and a Segmentation Fault. This issue has been patched in version 12.3.0.

Record
JLSEC-2026-777
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
Show 21 moreShow less
OSVOESA-2026-1149 5.3

harfbuzz security update

HarfBuzz is a text-shaping engine. If you give HarfBuzz a font and a string containing a sequence of Unicode codepoints, HarfBuzz selects and positions the corresponding glyphs from the font, applying all of the necessary layout rules and font features. HarfBuzz then returns the string to you in the form that is correctly arranged for the language and writing system.

Security Fix(es):

HarfBuzz is a text shaping engine. Prior to version 12.3.0, a null pointer dereference vulnerability exists in the SubtableUnicodesCache::create function located in src/hb-ot-cmap-table.hh. The function fails to check if hb_malloc returns NULL before using placement new to construct an object at the returned pointer address. When hb_malloc fails to allocate memory (which can occur in low-memory conditions or when using custom allocators that simulate allocation failures), it returns NULL. The code then attempts to call the constructor on this null pointer using placement new syntax, resulting in undefined behavior and a Segmentation Fault. This issue has been patched in version 12.3.0.(CVE-2026-22693)

Record
OESA-2026-1149
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVOESA-2026-1150 5.3

harfbuzz security update

HarfBuzz is a text-shaping engine. If you give HarfBuzz a font and a string containing a sequence of Unicode codepoints, HarfBuzz selects and positions the corresponding glyphs from the font, applying all of the necessary layout rules and font features. HarfBuzz then returns the string to you in the form that is correctly arranged for the language and writing system.

Security Fix(es):

HarfBuzz is a text shaping engine. Prior to version 12.3.0, a null pointer dereference vulnerability exists in the SubtableUnicodesCache::create function located in src/hb-ot-cmap-table.hh. The function fails to check if hb_malloc returns NULL before using placement new to construct an object at the returned pointer address. When hb_malloc fails to allocate memory (which can occur in low-memory conditions or when using custom allocators that simulate allocation failures), it returns NULL. The code then attempts to call the constructor on this null pointer using placement new syntax, resulting in undefined behavior and a Segmentation Fault. This issue has been patched in version 12.3.0.(CVE-2026-22693)

Record
OESA-2026-1150
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVOESA-2026-1203 5.3

harfbuzz security update

HarfBuzz is a text-shaping engine. If you give HarfBuzz a font and a string containing a sequence of Unicode codepoints, HarfBuzz selects and positions the corresponding glyphs from the font, applying all of the necessary layout rules and font features. HarfBuzz then returns the string to you in the form that is correctly arranged for the language and writing system.

Security Fix(es):

HarfBuzz is a text shaping engine. Prior to version 12.3.0, a null pointer dereference vulnerability exists in the SubtableUnicodesCache::create function located in src/hb-ot-cmap-table.hh. The function fails to check if hb_malloc returns NULL before using placement new to construct an object at the returned pointer address. When hb_malloc fails to allocate memory (which can occur in low-memory conditions or when using custom allocators that simulate allocation failures), it returns NULL. The code then attempts to call the constructor on this null pointer using placement new syntax, resulting in undefined behavior and a Segmentation Fault. This issue has been patched in version 12.3.0.(CVE-2026-22693)

Record
OESA-2026-1203
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVOESA-2026-1204 5.3

harfbuzz security update

HarfBuzz is a text-shaping engine. If you give HarfBuzz a font and a string containing a sequence of Unicode codepoints, HarfBuzz selects and positions the corresponding glyphs from the font, applying all of the necessary layout rules and font features. HarfBuzz then returns the string to you in the form that is correctly arranged for the language and writing system.

Security Fix(es):

HarfBuzz is a text shaping engine. Prior to version 12.3.0, a null pointer dereference vulnerability exists in the SubtableUnicodesCache::create function located in src/hb-ot-cmap-table.hh. The function fails to check if hb_malloc returns NULL before using placement new to construct an object at the returned pointer address. When hb_malloc fails to allocate memory (which can occur in low-memory conditions or when using custom allocators that simulate allocation failures), it returns NULL. The code then attempts to call the constructor on this null pointer using placement new syntax, resulting in undefined behavior and a Segmentation Fault. This issue has been patched in version 12.3.0.(CVE-2026-22693)

Record
OESA-2026-1204
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVOESA-2026-3759 8.6

openjdk-21 security update

The OpenJDK runtime environment.

Security Fix(es):

Buffer Overflow vulnerability in libpng 1.6.43-1.6.46 allows a local attacker to cause a denial of service via the pngimage with AddressSanitizer (ASan), the program leaks memory in various locations, eventually leading to high memory usage and causing the program to become unresponsive(CVE-2025-28162)

Buffer Overflow vulnerability in libpng 1.6.43-1.6.46 allows a local attacker to cause a denial of service via png_create_read_struct() function.(CVE-2025-28164)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D). Supported versions that are affected are Oracle Java SE: 8u451, 8u451-perf, 11.0.27, 17.0.15, 21.0.7, 24.0.1; Oracle GraalVM for JDK: 17.0.15, 21.0.7 and 24.0.1; Oracle GraalVM Enterprise Edition: 21.3.14. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in takeover of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).(CVE-2025-30749)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u451, 8u451-perf, 11.0.27, 17.0.15, 21.0.7, 24.0.1; Oracle GraalVM for JDK: 17.0.15, 21.0.7 and 24.0.1; Oracle GraalVM Enterprise Edition: 21.3.14. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).(CVE-2025-30754)

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Scripting). Supported versions that are affected are Oracle Java SE: 8u451, 8u451-perf and 11.0.27; Oracle GraalVM Enterprise Edition: 21.3.14. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies…

Record
OESA-2026-3759
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Updated
2026-11-02
OSVOESA-2026-3760 8.6

openjdk-21 security update

The OpenJDK runtime environment.

Security Fix(es):

Buffer Overflow vulnerability in libpng 1.6.43-1.6.46 allows a local attacker to cause a denial of service via the pngimage with AddressSanitizer (ASan), the program leaks memory in various locations, eventually leading to high memory usage and causing the program to become unresponsive(CVE-2025-28162)

Buffer Overflow vulnerability in libpng 1.6.43-1.6.46 allows a local attacker to cause a denial of service via png_create_read_struct() function.(CVE-2025-28164)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D). Supported versions that are affected are Oracle Java SE: 8u451, 8u451-perf, 11.0.27, 17.0.15, 21.0.7, 24.0.1; Oracle GraalVM for JDK: 17.0.15, 21.0.7 and 24.0.1; Oracle GraalVM Enterprise Edition: 21.3.14. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in takeover of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).(CVE-2025-30749)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u451, 8u451-perf, 11.0.27, 17.0.15, 21.0.7, 24.0.1; Oracle GraalVM for JDK: 17.0.15, 21.0.7 and 24.0.1; Oracle GraalVM Enterprise Edition: 21.3.14. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).(CVE-2025-30754)

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Scripting). Supported versions that are affected are Oracle Java SE: 8u451, 8u451-perf and 11.0.27; Oracle GraalVM Enterprise Edition: 21.3.14. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies…

Record
OESA-2026-3760
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Updated
2026-11-02
OSVOESA-2026-3761 8.6

openjdk-21 security update

The OpenJDK runtime environment.

Security Fix(es):

Buffer Overflow vulnerability in libpng 1.6.43-1.6.46 allows a local attacker to cause a denial of service via the pngimage with AddressSanitizer (ASan), the program leaks memory in various locations, eventually leading to high memory usage and causing the program to become unresponsive(CVE-2025-28162)

Buffer Overflow vulnerability in libpng 1.6.43-1.6.46 allows a local attacker to cause a denial of service via png_create_read_struct() function.(CVE-2025-28164)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D). Supported versions that are affected are Oracle Java SE: 8u451, 8u451-perf, 11.0.27, 17.0.15, 21.0.7, 24.0.1; Oracle GraalVM for JDK: 17.0.15, 21.0.7 and 24.0.1; Oracle GraalVM Enterprise Edition: 21.3.14. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in takeover of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).(CVE-2025-30749)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u451, 8u451-perf, 11.0.27, 17.0.15, 21.0.7, 24.0.1; Oracle GraalVM for JDK: 17.0.15, 21.0.7 and 24.0.1; Oracle GraalVM Enterprise Edition: 21.3.14. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).(CVE-2025-30754)

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Scripting). Supported versions that are affected are Oracle Java SE: 8u451, 8u451-perf and 11.0.27; Oracle GraalVM Enterprise Edition: 21.3.14. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies…

Record
OESA-2026-3761
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Updated
2026-11-02
OSVOESA-2026-3818 8.2

openjdk-11 security update

The OpenJDK runtime environment.

Security Fix(es):

Buffer Overflow vulnerability in libpng 1.6.43-1.6.46 allows a local attacker to cause a denial of service via the pngimage with AddressSanitizer (ASan), the program leaks memory in various locations, eventually leading to high memory usage and causing the program to become unresponsive(CVE-2025-28162)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u461, 8u461-perf, 11.0.28, 17.0.16, 21.0.8, 25; Oracle GraalVM for JDK: 17.0.16 and 21.0.8; Oracle GraalVM Enterprise Edition: 21.3.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data.(CVE-2025-53057)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). Supported versions that are affected are Oracle Java SE: 8u461, 8u461-perf, 11.0.28, 17.0.16, 21.0.8, 25; Oracle GraalVM for JDK: 17.0.16 and 21.0.8; Oracle GraalVM Enterprise Edition: 21.3.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).(CVE-2025-53066)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 21.0.8 and 25; Oracle GraalVM for JDK: 21.0.8; Oracle GraalVM Enterprise Edition: 21.3.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).(CVE-2025-61748)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: RMI). Supported versions that are affected are Oracle Java SE: 8u471, 8u471-b50, 8u471-perf, 11.0.29, 17.0.17, 21.0.9, 25.0.1; Oracle GraalVM for JDK: 17.0.17 and 21.0.9; Oracle GraalVM Enterprise Edition:…

Record
OESA-2026-3818
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Updated
2026-11-02
OSVOESA-2026-3927 8.6

openjdk-21 security update

The OpenJDK runtime environment.

Security Fix(es):

Buffer Overflow vulnerability in libpng 1.6.43-1.6.46 allows a local attacker to cause a denial of service via the pngimage with AddressSanitizer (ASan), the program leaks memory in various locations, eventually leading to high memory usage and causing the program to become unresponsive(CVE-2025-28162)

Buffer Overflow vulnerability in libpng 1.6.43-1.6.46 allows a local attacker to cause a denial of service via png_create_read_struct() function.(CVE-2025-28164)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D). Supported versions that are affected are Oracle Java SE: 8u451, 8u451-perf, 11.0.27, 17.0.15, 21.0.7, 24.0.1; Oracle GraalVM for JDK: 17.0.15, 21.0.7 and 24.0.1; Oracle GraalVM Enterprise Edition: 21.3.14. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in takeover of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).(CVE-2025-30749)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u451, 8u451-perf, 11.0.27, 17.0.15, 21.0.7, 24.0.1; Oracle GraalVM for JDK: 17.0.15, 21.0.7 and 24.0.1; Oracle GraalVM Enterprise Edition: 21.3.14. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).(CVE-2025-30754)

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Scripting). Supported versions that are affected are Oracle Java SE: 8u451, 8u451-perf and 11.0.27; Oracle GraalVM Enterprise Edition: 21.3.14. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies…

Record
OESA-2026-3927
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Updated
2026-11-02
OSVRHSA-2026:7701 5.3

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:7701
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVROOT-OS-DEBIAN-11-CVE-2026-22693 5.3

CVE-2026-22693 in harfbuzz - Patched by Root

Root has patched CVE-2026-22693 in the harfbuzz package for Root:Debian:11. Multiple fixed versions available.

Record
ROOT-OS-DEBIAN-11-CVE-2026-22693
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVROOT-OS-DEBIAN-12-CVE-2026-22693 5.3

CVE-2026-22693 in harfbuzz - Patched by Root

Root has patched CVE-2026-22693 in the harfbuzz package for Root:Debian:12. Multiple fixed versions available.

Record
ROOT-OS-DEBIAN-12-CVE-2026-22693
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVUBUNTU-CVE-2026-22693 5.3

HarfBuzz is a text shaping engine. Prior to version 12.3.0, a null pointer dereference vulnerability exists in the SubtableUnicodesCache::create function located in src/hb-ot-cmap-table.hh. The function fails to check if hb_malloc returns NULL before using placement new to construct an object at the returned pointer address. When hb_malloc fails to allocate memory (which can occur in low-memory conditions or when using custom allocators that simulate allocation failures), it returns NULL. The code then attempts to call the constructor on this null pointer using placement new syntax, resulting in undefined behavior and a Segmentation Fault. This issue has been patched in version 12.3.0.

Record
UBUNTU-CVE-2026-22693
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVAZL-73970 No score

CVE-2026-22693 affecting package harfbuzz for versions less than 8.3.0-4

HarfBuzz is a text shaping engine. Prior to version 12.3.0, a null pointer dereference vulnerability exists in the SubtableUnicodesCache::create function located in src/hb-ot-cmap-table.hh. The function fails to check if hb_malloc returns NULL before using placement new to construct an object at the returned pointer address. When hb_malloc fails to allocate memory (which can occur in low-memory conditions or when using custom allocators that simulate allocation failures), it returns NULL. The code then attempts to call the constructor on this null pointer using placement new syntax, resulting in undefined behavior and a Segmentation Fault. This issue has been patched in version 12.3.0.

Record
AZL-73970
Updated
2026-11-02
OSVMGASA-2026-0015 No score

Updated harfbuzz packages fix security vulnerability

Null Pointer Dereference in SubtableUnicodesCache::create leading to DoS. (CVE-2026-22693)

Record
MGASA-2026-0015
Updated
2026-11-02
OSVopenSUSE-SU-2026:10065-1 No score

harfbuzz-devel-12.3.0-2.1 on GA media

These are all security issues fixed in the harfbuzz-devel-12.3.0-2.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:10065-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:20409-1 No score

Security update for harfbuzz

This update for harfbuzz fixes the following issues:

Update to version 11.4.5:

Security fixes:

  • CVE-2026-22693: Fixed a NULL pointer dereference in SubtableUnicodesCache::create (bsc#1256459).

Other fixes:

  • Bug fixes for “AAT” shaping, and other shaping micro optimizations.
  • Fix a shaping regression affecting mark glyphs in certain fonts.
  • Fix pruning of mark filtering sets when subsetting fonts, which caused changes in shaping behaviour.
  • Make shaping fail much faster for certain malformed fonts (e.g., those that trigger infinite recursion).
  • Fix undefined behaviour introduced in 11.4.2.
  • Fix detection of the “Cambria Math” font when fonts are scaled, so the workaround for the bad MATH table constant is applied.
  • Various performance and memory usage improvements.
  • The hb-shape command line tool can now be built with the amalgamated harfbuzz.cc source.
  • Fix regression in handling version 2 of avar table.
  • Increase various buffer length limits for better handling of fonts that generate huge number of glyphs per codepoint (e.g. Noto Sans Duployan).
  • Improvements to the harfrust shaper for more accurate testing.
  • Fix clang compiler warnings.
  • General shaping and subsetting speedups.
  • Fix in Graphite shaping backend when glyph advances became negative.
  • Subsetting improvements, pruning empty mark-attachment lookups.
  • Don't use the macro name _S, which is reserved by system liberaries.
  • Build fixes and speedup.
  • Add a kbts shaping backend that calls into the kb_text_shape single-header shaping library. This is purely for testing and performance evaluation and we do NOT recommend using it for any other purposes.
  • Fix bug in vertical shaping of fonts without the vmtx table.
  • Fix build with non-compliant C++11 compilers that don't recognize the "and" keyword.
  • Fix crasher in the glyph_v_origin function introduced in 11.3.0.
  • Speed up handling fonts with very large number of variations.
  • Speed up getting horizontal and vertical glyph advances by up to 24%.
  • Significantly speed up vertical text shaping.
  • Various documentation improvements.
  • Various build improvements.
  • Various subsetting improvements.
  • Various improvements to Rust font functions (fontations integration) and shaper (HarfRust integration).
  • Rename harfruzz option and shaper to harfrust following upstream rename.
  • Implement hb_face_reference_blob() for DirectWrite font functions.
  • Various build improvements.
  • Fix build with HB_NO_DRAW and HB_NO_PAINT.
  • Add an optional harfruzz shaper that uses HarfRuzz; an ongoing Rust port of HarfBuzz shaping. This shaper is mainly used for testing the output of the Rust implementation.
  • Fix regression that caused applying unsafe_to_break() to the whole buffer to be ignored.
  • Update USE data files.
  • Fix getting advances of out-of-rage glyph indices in DirectWrite font functions.
  • Painting of COLRv1 fonts without clip boxes is now about 10 times faster.
  • Synthetic bold/slant of a sub font is now respected, instead of using the parent’s.
  • Glyph extents for fonts synthetic bold/slant are now accurately calculated.
  • Various build fixes.
  • Include bidi mirroring variants of the requested codepoints when subsetting. The new HB_SUBSET_FLAGS_NO_BIDI_CLOSURE can be used to disable this behaviour.
  • Various bug fixes.
  • Various build fixes and improvements.
  • Various test suite improvements.
  • The change in version 10.3.0 to apply “trak” table tracking values to glyph advances directly has been reverted as it required every font functions implementation to handle it, which breaks existing custom font functions. Tracking is instead back to being applied during shaping.
  • When directwrite integration is enabled, we now link to dwrite.dll instead of dynamically loading…
Record
openSUSE-SU-2026:20409-1
Updated
2026-11-02
OSVROOT-OS-DEBIAN-13-CVE-2026-22693 No score

CVE-2026-22693 in rootio-harfbuzz - Patched by Root

Root has patched CVE-2026-22693 in the rootio-harfbuzz package for Root:Debian:13. Multiple fixed versions available.

Record
ROOT-OS-DEBIAN-13-CVE-2026-22693
Updated
2026-11-02
OSVSUSE-SU-2026:0287-1 No score

Security update for harfbuzz

This update for harfbuzz fixes the following issues:

  • CVE-2026-22693: Fixed a NULL pointer dereference in SubtableUnicodesCache::create (bsc#1256459).
Record
SUSE-SU-2026:0287-1
Updated
2026-11-02
OSVSUSE-SU-2026:20762-1 No score

Security update for harfbuzz

This update for harfbuzz fixes the following issues:

Update to version 11.4.5:

Security fixes:

  • CVE-2026-22693: Fixed a NULL pointer dereference in SubtableUnicodesCache::create (bsc#1256459).

Other fixes:

  • Bug fixes for “AAT” shaping, and other shaping micro optimizations.
  • Fix a shaping regression affecting mark glyphs in certain fonts.
  • Fix pruning of mark filtering sets when subsetting fonts, which caused changes in shaping behaviour.
  • Make shaping fail much faster for certain malformed fonts (e.g., those that trigger infinite recursion).
  • Fix undefined behaviour introduced in 11.4.2.
  • Fix detection of the “Cambria Math” font when fonts are scaled, so the workaround for the bad MATH table constant is applied.
  • Various performance and memory usage improvements.
  • The hb-shape command line tool can now be built with the amalgamated harfbuzz.cc source.
  • Fix regression in handling version 2 of avar table.
  • Increase various buffer length limits for better handling of fonts that generate huge number of glyphs per codepoint (e.g. Noto Sans Duployan).
  • Improvements to the harfrust shaper for more accurate testing.
  • Fix clang compiler warnings.
  • General shaping and subsetting speedups.
  • Fix in Graphite shaping backend when glyph advances became negative.
  • Subsetting improvements, pruning empty mark-attachment lookups.
  • Don't use the macro name _S, which is reserved by system liberaries.
  • Build fixes and speedup.
  • Add a kbts shaping backend that calls into the kb_text_shape single-header shaping library. This is purely for testing and performance evaluation and we do NOT recommend using it for any other purposes.
  • Fix bug in vertical shaping of fonts without the vmtx table.
  • Fix build with non-compliant C++11 compilers that don't recognize the "and" keyword.
  • Fix crasher in the glyph_v_origin function introduced in 11.3.0.
  • Speed up handling fonts with very large number of variations.
  • Speed up getting horizontal and vertical glyph advances by up to 24%.
  • Significantly speed up vertical text shaping.
  • Various documentation improvements.
  • Various build improvements.
  • Various subsetting improvements.
  • Various improvements to Rust font functions (fontations integration) and shaper (HarfRust integration).
  • Rename harfruzz option and shaper to harfrust following upstream rename.
  • Implement hb_face_reference_blob() for DirectWrite font functions.
  • Various build improvements.
  • Fix build with HB_NO_DRAW and HB_NO_PAINT.
  • Add an optional harfruzz shaper that uses HarfRuzz; an ongoing Rust port of HarfBuzz shaping. This shaper is mainly used for testing the output of the Rust implementation.
  • Fix regression that caused applying unsafe_to_break() to the whole buffer to be ignored.
  • Update USE data files.
  • Fix getting advances of out-of-rage glyph indices in DirectWrite font functions.
  • Painting of COLRv1 fonts without clip boxes is now about 10 times faster.
  • Synthetic bold/slant of a sub font is now respected, instead of using the parent’s.
  • Glyph extents for fonts synthetic bold/slant are now accurately calculated.
  • Various build fixes.
  • Include bidi mirroring variants of the requested codepoints when subsetting. The new HB_SUBSET_FLAGS_NO_BIDI_CLOSURE can be used to disable this behaviour.
  • Various bug fixes.
  • Various build fixes and improvements.
  • Various test suite improvements.
  • The change in version 10.3.0 to apply “trak” table tracking values to glyph advances directly has been reverted as it required every font functions implementation to handle it, which breaks existing custom font functions. Tracking is instead back to being applied during shaping.
  • When directwrite integration is enabled, we now link to dwrite.dll instead of dynamically loading…
Record
SUSE-SU-2026:20762-1
Updated
2026-11-02
OSVSUSE-SU-2026:20922-1 No score

Security update for harfbuzz

This update for harfbuzz fixes the following issues:

Update to version 11.4.5:

Security fixes:

  • CVE-2026-22693: Fixed a NULL pointer dereference in SubtableUnicodesCache::create (bsc#1256459).

Other fixes:

  • Bug fixes for “AAT” shaping, and other shaping micro optimizations.
  • Fix a shaping regression affecting mark glyphs in certain fonts.
  • Fix pruning of mark filtering sets when subsetting fonts, which caused changes in shaping behaviour.
  • Make shaping fail much faster for certain malformed fonts (e.g., those that trigger infinite recursion).
  • Fix undefined behaviour introduced in 11.4.2.
  • Fix detection of the “Cambria Math” font when fonts are scaled, so the workaround for the bad MATH table constant is applied.
  • Various performance and memory usage improvements.
  • The hb-shape command line tool can now be built with the amalgamated harfbuzz.cc source.
  • Fix regression in handling version 2 of avar table.
  • Increase various buffer length limits for better handling of fonts that generate huge number of glyphs per codepoint (e.g. Noto Sans Duployan).
  • Improvements to the harfrust shaper for more accurate testing.
  • Fix clang compiler warnings.
  • General shaping and subsetting speedups.
  • Fix in Graphite shaping backend when glyph advances became negative.
  • Subsetting improvements, pruning empty mark-attachment lookups.
  • Don't use the macro name _S, which is reserved by system liberaries.
  • Build fixes and speedup.
  • Add a kbts shaping backend that calls into the kb_text_shape single-header shaping library. This is purely for testing and performance evaluation and we do NOT recommend using it for any other purposes.
  • Fix bug in vertical shaping of fonts without the vmtx table.
  • Fix build with non-compliant C++11 compilers that don't recognize the "and" keyword.
  • Fix crasher in the glyph_v_origin function introduced in 11.3.0.
  • Speed up handling fonts with very large number of variations.
  • Speed up getting horizontal and vertical glyph advances by up to 24%.
  • Significantly speed up vertical text shaping.
  • Various documentation improvements.
  • Various build improvements.
  • Various subsetting improvements.
  • Various improvements to Rust font functions (fontations integration) and shaper (HarfRust integration).
  • Rename harfruzz option and shaper to harfrust following upstream rename.
  • Implement hb_face_reference_blob() for DirectWrite font functions.
  • Various build improvements.
  • Fix build with HB_NO_DRAW and HB_NO_PAINT.
  • Add an optional harfruzz shaper that uses HarfRuzz; an ongoing Rust port of HarfBuzz shaping. This shaper is mainly used for testing the output of the Rust implementation.
  • Fix regression that caused applying unsafe_to_break() to the whole buffer to be ignored.
  • Update USE data files.
  • Fix getting advances of out-of-rage glyph indices in DirectWrite font functions.
  • Painting of COLRv1 fonts without clip boxes is now about 10 times faster.
  • Synthetic bold/slant of a sub font is now respected, instead of using the parent’s.
  • Glyph extents for fonts synthetic bold/slant are now accurately calculated.
  • Various build fixes.
  • Include bidi mirroring variants of the requested codepoints when subsetting. The new HB_SUBSET_FLAGS_NO_BIDI_CLOSURE can be used to disable this behaviour.
  • Various bug fixes.
  • Various build fixes and improvements.
  • Various test suite improvements.
  • The change in version 10.3.0 to apply “trak” table tracking values to glyph advances directly has been reverted as it required every font functions implementation to handle it, which breaks existing custom font functions. Tracking is instead back to being applied during shaping.
  • When directwrite integration is enabled, we now link to dwrite.dll instead of dynamically loading…
Record
SUSE-SU-2026:20922-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
harfbuzz
Azure Linux:3
 before 8.3.0-4
8.3.0-4
harfbuzz
Debian:12
 All versions, plus listed versions
10.0.1-110.1.0-110.1.0-210.2.0-110.2.0-2
Show 19 moreShow less
11.4.5-111.5.0-112.1.0-112.2.0-112.3.0-112.3.0-212.3.0-312.3.0-412.3.1-112.3.2-112.3.2-26.0.0+dfsg-38.0.0-18.0.0-28.0.0-38.0.1-18.3.0-18.3.0-29.0.0-1
 None known
harfbuzz
Debian:13
 before 10.2.0-1+deb13u1, plus listed versions
10.2.0-1
10.2.0-1+deb13u1
harfbuzz
Debian:14
 before 12.3.0-4, plus listed versions
10.2.0-110.2.0-211.4.5-111.5.0-112.1.0-1
Show 4 moreShow less
12.2.0-112.3.0-112.3.0-212.3.0-3
12.3.0-4
HarfBuzz_ICU_jll
Julia
 before 100.14002.1+0
100.14002.1+0
HarfBuzz_jll
Julia
 before 100.14002.1+0
100.14002.1+0
harfbuzz
Mageia:9
 before 7.0.1-1.2.mga9
7.0.1-1.2.mga9
harfbuzz
openEuler:24.03-LTS-SP1
 before 8.3.0-4.oe2403sp1
8.3.0-4.oe2403sp1
harfbuzz
openEuler:24.03-LTS
 before 8.3.0-4.oe2403
8.3.0-4.oe2403
harfbuzz
openEuler:24.03-LTS-SP2
 before 8.3.0-4.oe2403sp2
8.3.0-4.oe2403sp2
Show 30 moreShow less
Affected packages
PackageAffectedFixed
harfbuzz
openEuler:24.03-LTS-SP3
 before 8.3.0-4.oe2403sp3
8.3.0-4.oe2403sp3
openjdk-21
openEuler:22.03-LTS-SP4
 before java-21-openjdk-21.0.12.8-4.oe2203sp4
java-21-openjdk-21.0.12.8-4.oe2203sp4
openjdk-21
openEuler:24.03-LTS-SP1
 before java-21-openjdk-21.0.12.8-4.oe2403sp1
java-21-openjdk-21.0.12.8-4.oe2403sp1
openjdk-21
openEuler:24.03-LTS-SP4
 before java-21-openjdk-21.0.12.8-4.oe2403sp4
java-21-openjdk-21.0.12.8-4.oe2403sp4
openjdk-11
openEuler:20.03-LTS-SP4
 before java-11-openjdk-11.0.32.9-1.oe2003sp4
java-11-openjdk-11.0.32.9-1.oe2003sp4
openjdk-11
openEuler:22.03-LTS-SP4
 before java-11-openjdk-11.0.32.9-1.oe2203sp4
java-11-openjdk-11.0.32.9-1.oe2203sp4
openjdk-11
openEuler:24.03-LTS-SP1
 before java-11-openjdk-11.0.32.9-1.oe2403sp1
java-11-openjdk-11.0.32.9-1.oe2403sp1
openjdk-11
openEuler:24.03-LTS-SP3
 before java-11-openjdk-11.0.32.9-1.oe2403sp3
java-11-openjdk-11.0.32.9-1.oe2403sp3
openjdk-11
openEuler:24.03-LTS-SP4
 before java-11-openjdk-11.0.32.9-1.oe2403sp4
java-11-openjdk-11.0.32.9-1.oe2403sp4
openjdk-21
openEuler:24.03-LTS-SP3
 before java-21-openjdk-21.0.12.8-4.oe2403sp3
java-21-openjdk-21.0.12.8-4.oe2403sp3
harfbuzz
Red Hat:hummingbird:1
 before 0:14.1.0-2.hum1
0:14.1.0-2.hum1
harfbuzz-cairo
Red Hat:hummingbird:1
 before 0:14.1.0-2.hum1
0:14.1.0-2.hum1
harfbuzz-devel
Red Hat:hummingbird:1
 before 0:14.1.0-2.hum1
0:14.1.0-2.hum1
harfbuzz-gpu
Red Hat:hummingbird:1
 before 0:14.1.0-2.hum1
0:14.1.0-2.hum1
harfbuzz-icu
Red Hat:hummingbird:1
 before 0:14.1.0-2.hum1
0:14.1.0-2.hum1
harfbuzz-raster
Red Hat:hummingbird:1
 before 0:14.1.0-2.hum1
0:14.1.0-2.hum1
harfbuzz-vector
Red Hat:hummingbird:1
 before 0:14.1.0-2.hum1
0:14.1.0-2.hum1
harfbuzz
Root:Debian:11
 before 2.7.4-1.aikido.8
2.7.4-1.aikido.82.7.4-1.root.io.7
rootio-harfbuzz
Root:Debian:11
 before 2.7.4-1.aikido.8
2.7.4-1.aikido.82.7.4-1.root.io.7
harfbuzz
Root:Debian:12
 before 6.0.0+dfsg-3.root.io.3
6.0.0+dfsg-3.root.io.36.0.0+dfsg-3.root.io.46.0.0+dfsg-3.aikido.5
rootio-harfbuzz
Root:Debian:12
 before 6.0.0+dfsg-3.root.io.3
6.0.0+dfsg-3.root.io.36.0.0+dfsg-3.root.io.46.0.0+dfsg-3.aikido.5
harfbuzz
SUSE:Linux Enterprise Module for Basesystem 15 SP7
 before 8.3.0-150600.3.3.1
8.3.0-150600.3.3.1
harfbuzz
openSUSE:Leap 15.6
 before 8.3.0-150600.3.3.1
8.3.0-150600.3.3.1
harfbuzz
SUSE:Linux Micro 6.2
 before 11.4.5-160000.1.1
11.4.5-160000.1.1
harfbuzz
SUSE:Linux Enterprise Server 16.0
 before 11.4.5-160000.1.1
11.4.5-160000.1.1
harfbuzz
SUSE:Linux Enterprise Server for SAP applications 16.0
 before 11.4.5-160000.1.1
11.4.5-160000.1.1
harfbuzz
Ubuntu:24.04:LTS
 All versions, plus listed versions
8.0.1-18.0.1-1build18.3.0-28.3.0-2build18.3.0-2build2
 None known
harfbuzz
Ubuntu:25.10
 All versions, plus listed versions
10.2.0-1
 None known
harfbuzz
openSUSE:Tumbleweed
 before 12.3.0-2.1
12.3.0-2.1
harfbuzz
openSUSE:Leap 16.0
 before 11.4.5-160000.1.1
11.4.5-160000.1.1

History

History
RecordedChangedSources
affected
first indexedCVE List, EUVD, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-22693 is a medium vulnerability (CVSS 5.3) in Harfbuzz, published January 10, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.45%, the 39th percentile. Fixed in harfbuzz 8.3.0-4.

References

Show 72 moreShow less
This page doesn't list everything

Left out here: the rest of 8 source descriptions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open