Null Pointer Dereference Vulnerability in HarfBuzz Text Shaping Engine

CVE-2026-22693

What is CVE-2026-22693?

A null pointer dereference vulnerability exists in the HarfBuzz text shaping engine prior to version 12.3.0. Specifically, the issue resides in the SubtableUnicodesCache::create function, where memory allocation via hb_malloc is not adequately checked. If hb_malloc fails, it returns a NULL pointer, and the subsequent code attempts to use placement new to construct an object at this address, leading to undefined behavior and potential Segmentation Faults. This flaw can manifest particularly in low-memory environments or when using custom allocators that simulate allocation failures, impacting the stability and functionality of applications leveraging HarfBuzz.

References