OESA-2026-1203

See a problem?
Please try reporting it to the source first.

Source

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2026-1203

Import Source

https://repo.openeuler.org/security/data/osv/OESA-2026-1203.json

JSON Data

https://api.test.osv.dev/v1/vulns/OESA-2026-1203

Upstream

CVE-2026-22693

Published

2026-01-23T12:23:05Z

Modified

2026-01-23T12:45:00.636374Z

Summary

harfbuzz security update

Details

HarfBuzz is a text-shaping engine. If you give HarfBuzz a font and a string containing a sequence of Unicode codepoints, HarfBuzz selects and positions the corresponding glyphs from the font, applying all of the necessary layout rules and font features. HarfBuzz then returns the string to you in the form that is correctly arranged for the language and writing system.

Security Fix(es):

HarfBuzz is a text shaping engine. Prior to version 12.3.0, a null pointer dereference vulnerability exists in the SubtableUnicodesCache::create function located in src/hb-ot-cmap-table.hh. The function fails to check if hbmalloc returns NULL before using placement new to construct an object at the returned pointer address. When hbmalloc fails to allocate memory (which can occur in low-memory conditions or when using custom allocators that simulate allocation failures), it returns NULL. The code then attempts to call the constructor on this null pointer using placement new syntax, resulting in undefined behavior and a Segmentation Fault. This issue has been patched in version 12.3.0.(CVE-2026-22693)

Database specific

{
    "severity": "Medium"
}

References

Affected packages

openEuler:24.03-LTS-SP2 / harfbuzz

Package

Name: harfbuzz
Purl: pkg:rpm/openEuler/harfbuzz&distro=openEuler-24.03-LTS-SP2

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

8.3.0-4.oe2403sp2

Ecosystem specific

{
    "aarch64": [
        "harfbuzz-8.3.0-4.oe2403sp2.aarch64.rpm",
        "harfbuzz-debuginfo-8.3.0-4.oe2403sp2.aarch64.rpm",
        "harfbuzz-debugsource-8.3.0-4.oe2403sp2.aarch64.rpm",
        "harfbuzz-devel-8.3.0-4.oe2403sp2.aarch64.rpm"
    ],
    "x86_64": [
        "harfbuzz-8.3.0-4.oe2403sp2.x86_64.rpm",
        "harfbuzz-debuginfo-8.3.0-4.oe2403sp2.x86_64.rpm",
        "harfbuzz-debugsource-8.3.0-4.oe2403sp2.x86_64.rpm",
        "harfbuzz-devel-8.3.0-4.oe2403sp2.x86_64.rpm"
    ],
    "noarch": [
        "harfbuzz-help-8.3.0-4.oe2403sp2.noarch.rpm"
    ],
    "src": [
        "harfbuzz-8.3.0-4.oe2403sp2.src.rpm"
    ]
}

Database specific

source

"https://repo.openeuler.org/security/data/osv/OESA-2026-1203.json"