azure linux harfbuzz vulnerabilities

Latest azure linux harfbuzz CVEs

Newest publication first

1. CVE-2026-22693 Null Pointer Dereference in SubtableUnicodesCache::create leading to DoS

   Published 2026-01-10

   Medium·CVSS 5.3 EPSS 0.45%

   HarfBuzz is a text shaping engine. Prior to version 12.3.0, a null pointer dereference vulnerability exists in the SubtableUnicodesCache::create function located in src/hb-ot-cmap-table.hh. The function fails to check if hb_malloc returns NULL before using placement new to constr...

2. CVE-2024-56732 HarfBuzz heap-buffer-overflow on hb_cairo_glyphs_from_buffer

   Published 2024-12-27

   Critical·CVSS 9.3 EPSS 0.65%

   HarfBuzz is a text shaping engine. Starting with 8.5.0 through 10.0.1, there is a heap-based buffer overflow in the hb_cairo_glyphs_from_buffer function.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.