{"id":"OSV-2023-137","aliases":[],"status":"published","title":"Heap-buffer-overflow in OT::Layout::Common::Coverage::get_population","description":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=56510\n\n```\nCrash type: Heap-buffer-overflow READ 1\nCrash state:\nOT::Layout::Common::Coverage::get_population\nOT::Layout::GPOS_impl::SinglePosFormat1::sanitize\nhb_sanitize_context_t::return_t OT::Layout::GPOS_impl::PosLookupSubTable::dispat\n```","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2023-03-03T13:00:38.278632Z","modified":"2026-01-21T00:33:41Z","affected":[{"source":"osv","ecosystem":"OSS-Fuzz","package":"harfbuzz","ranges":[{"type":"GIT","events":[{"introduced":"918193ebf908d35c88bb71d02dfc14bc41ffc31d"},{"fixed":"08784baf101aea472c133dcd67604b475ace3772"}]}],"versions":["7.1.0","7.2.0","7.3.0","8.0.0","8.0.1","8.1.0","8.1.1","8.2.0","8.2.1","8.2.2","8.3.0","8.3.1","8.4.0","8.5.0","9.0.0","10.0.0","10.0.1","10.1.0","10.2.0","10.3.0","10.4.0","11.0.0","11.0.1","11.1.0","11.2.0","11.2.1","11.3.0","11.3.1","11.3.2","11.3.3","11.4.0","11.4.1","11.4.2","11.4.3","11.4.4","11.4.5","11.5.0","11.5.1","12.0.0","12.1.0","12.2.0","12.3.0"]}],"references":[{"url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=56510","tags":["report"]}],"sources":{"osv":[{"id":"OSV-2023-137","title":"Heap-buffer-overflow in OT::Layout::Common::Coverage::get_population","description":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=56510\n\n```\nCrash type: Heap-buffer-overflow READ 1\nCrash state:\nOT::Layout::Common::Coverage::get_population\nOT::Layout::GPOS_impl::SinglePosFormat1::sanitize\nhb_sanitize_context_t::return_t OT::Layout::GPOS_impl::PosLookupSubTable::dispat\n```\n","status":"published","published":"2023-03-03T13:00:38.278632Z","modified":"2026-01-21T00:33:41.940724Z","updated_at":"2026-11-02T15:52:49.511349Z"}]}}