CVE-2026-22693: Null Pointer Dereference in SubtableUnicodesCache::create leading to DoS
HarfBuzz is a text shaping engine. Prior to version 12.3.0, a null pointer dereference vulnerability exists in the SubtableUnicodesCache::create function located in src/hb-ot-cmap-table.hh. The function fails to check if hbmalloc returns NULL before using placement new to construct an object at the returned pointer address. When hbmalloc fails to allocate memory (which can occur in low-memory conditions or when using custom allocators that simulate allocation failures), it returns NULL. The code then attempts to call the constructor on this null pointer using placement new syntax, resulting in undefined behavior and a Segmentation Fault. This issue has been patched in version 12.3.0.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2026-22693?
CVE-2026-22693 is categorized as a critical vulnerability due to its potential for causing application crashes and possible exploitation.
How do I fix CVE-2026-22693?
To fix CVE-2026-22693, upgrade HarfBuzz to version 12.3.0 or later.
What does CVE-2026-22693 affect?
CVE-2026-22693 affects HarfBuzz versions prior to 12.3.0.
What type of vulnerability is CVE-2026-22693?
CVE-2026-22693 is a null pointer dereference vulnerability found in the SubtableUnicodesCache::create function.
Can CVE-2026-22693 be exploited remotely?
CVE-2026-22693 may be exploited remotely if the vulnerable application is exposed to untrusted input.