CVE-2026-22693 - Null Pointer Dereference in SubtableUnicodesCache::create leading to DoS

Back Back to CVE browser

MEDIUM

Null Pointer Dereference in SubtableUnicodesCache::create leading to DoS

Published Jan 10, 2026

5.3

MEDIUM

CVSS 3.1

EPSS 0.45%

Description

HarfBuzz is a text shaping engine. Prior to version 12.3.0, a null pointer dereference vulnerability exists in the SubtableUnicodesCache::create function located in src/hb-ot-cmap-table.hh. The function fails to check if hb_malloc returns NULL before using placement new to construct an object at the returned pointer address. When hb_malloc fails to allocate memory (which can occur in low-memory conditions or when using custom allocators that simulate allocation failures), it returns NULL. The code then attempts to call the constructor on this null pointer using placement new syntax, resulting in undefined behavior and a Segmentation Fault. This issue has been patched in version 12.3.0.

Affected products

Vendor Harfbuzz Product Harfbuzz Default
n/a
- Version
  < 12.3.0
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Harfbuzz

n/a

Version	Status	Constraints
< 12.3.0	affected	-

Red Hat Hardened Images

harfbuzz-main-14.1.0-2.hum1

Fixed · RHSA-2026:7701
Red Hat Enterprise Linux 10

firefox

Fix deferred
Red Hat Enterprise Linux 10

harfbuzz

Fix deferred
Red Hat Enterprise Linux 10

java-21-openjdk

Fix deferred
Red Hat Enterprise Linux 10

java-25-openjdk

Fix deferred
Red Hat Enterprise Linux 10

thunderbird

Fix deferred
Red Hat Enterprise Linux 7

firefox

Fix deferred
Red Hat Enterprise Linux 7

harfbuzz

Fix deferred
Red Hat Enterprise Linux 8

firefox

Fix deferred
Red Hat Enterprise Linux 8

harfbuzz

Fix deferred
Red Hat Enterprise Linux 8

java-17-openjdk

Fix deferred
Red Hat Enterprise Linux 8

java-21-openjdk

Fix deferred
Red Hat Enterprise Linux 8

mingw-harfbuzz

Fix deferred
Red Hat Enterprise Linux 8

thunderbird

Fix deferred
Red Hat Enterprise Linux 9

firefox

Fix deferred
Red Hat Enterprise Linux 9

harfbuzz

Fix deferred
Red Hat Enterprise Linux 9

java-17-openjdk

Fix deferred
Red Hat Enterprise Linux 9

java-21-openjdk

Fix deferred
Red Hat Enterprise Linux 9

java-25-openjdk

Fix deferred
Red Hat Enterprise Linux 9

thunderbird

Fix deferred
Red Hat build of OpenJDK 11 ELS

java-11-openjdk

Fix deferred
Red Hat build of OpenJDK 11 ELS

java-11-openjdk-portable

Fix deferred
Red Hat build of OpenJDK 17

java-17-openjdk-portable

Fix deferred
Red Hat build of OpenJDK 21

java-21-openjdk-portable

Fix deferred
Red Hat build of OpenJDK 25

java-25-openjdk-portable

Fix deferred

Product	Package	State	Advisory
Red Hat Hardened Images	harfbuzz-main-14.1.0-2.hum1	Fixed	RHSA-2026:7701
Red Hat Enterprise Linux 10	firefox	Fix deferred	n/a
Red Hat Enterprise Linux 10	harfbuzz	Fix deferred	n/a
Red Hat Enterprise Linux 10	java-21-openjdk	Fix deferred	n/a
Red Hat Enterprise Linux 10	java-25-openjdk	Fix deferred	n/a
Red Hat Enterprise Linux 10	thunderbird	Fix deferred	n/a
Red Hat Enterprise Linux 7	firefox	Fix deferred	n/a
Red Hat Enterprise Linux 7	harfbuzz	Fix deferred	n/a
Red Hat Enterprise Linux 8	firefox	Fix deferred	n/a
Red Hat Enterprise Linux 8	harfbuzz	Fix deferred	n/a
Red Hat Enterprise Linux 8	java-17-openjdk	Fix deferred	n/a
Red Hat Enterprise Linux 8	java-21-openjdk	Fix deferred	n/a
Red Hat Enterprise Linux 8	mingw-harfbuzz	Fix deferred	n/a
Red Hat Enterprise Linux 8	thunderbird	Fix deferred	n/a
Red Hat Enterprise Linux 9	firefox	Fix deferred	n/a
Red Hat Enterprise Linux 9	harfbuzz	Fix deferred	n/a
Red Hat Enterprise Linux 9	java-17-openjdk	Fix deferred	n/a
Red Hat Enterprise Linux 9	java-21-openjdk	Fix deferred	n/a
Red Hat Enterprise Linux 9	java-25-openjdk	Fix deferred	n/a
Red Hat Enterprise Linux 9	thunderbird	Fix deferred	n/a
Red Hat build of OpenJDK 11 ELS	java-11-openjdk	Fix deferred	n/a
Red Hat build of OpenJDK 11 ELS	java-11-openjdk-portable	Fix deferred	n/a
Red Hat build of OpenJDK 17	java-17-openjdk-portable	Fix deferred	n/a
Red Hat build of OpenJDK 21	java-21-openjdk-portable	Fix deferred	n/a
Red Hat build of OpenJDK 25	java-25-openjdk-portable	Fix deferred	n/a

Remediation

Red Hat statement

This MODERATE severity null pointer dereference in the HarfBuzz library may cause a denial of service (segmentation fault) when memory allocation fails in hb_malloc. The issue affects Red Hat products that include and link against HarfBuzz, such as OpenJDK builds with the java.desktop module and certain RHEL components like Firefox and Thunderbird. The java-17-openjdk-headless and java-21-openjdk-headless packages do not include java.desktop and do not link against HarfBuzz; therefore, headless-only environments are not affected.

Red Hat mitigation

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

Weaknesses (1)

CWE-476

NULL Pointer Dereference

References (9)

http://www.openwall.com/lists/oss-security/2026/01/11/1
ExploitMailing ListPatchThird Party Advisory
http://www.openwall.com/lists/oss-security/2026/01/12/1
ExploitMailing ListPatchThird Party Advisory
https://access.redhat.com/security/cve/CVE-2026-22693
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2428439
Issue Tracking
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-1871
Advisory
https://github.com/harfbuzz/harfbuzz/commit/1265ff8d990284f04d8768f35b0e20ae5f60daae
x_refsource_MISCPatch
https://github.com/harfbuzz/harfbuzz/security/advisories/GHSA-xvjr-f2r9-c7ww
x_refsource_CONFIRMExploitMitigationVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-22693
https://www.cve.org/CVERecord?id=CVE-2026-22693

Link	Providers	Tags
http://www.openwall.com/lists/oss-security/2026/01/11/1		ExploitMailing ListPatchThird Party Advisory
http://www.openwall.com/lists/oss-security/2026/01/12/1		ExploitMailing ListPatchThird Party Advisory
https://access.redhat.com/security/cve/CVE-2026-22693		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2428439		Issue Tracking
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-1871		Advisory
https://github.com/harfbuzz/harfbuzz/commit/1265ff8d990284f04d8768f35b0e20ae5f60daae		x_refsource_MISCPatch
https://github.com/harfbuzz/harfbuzz/security/advisories/GHSA-xvjr-f2r9-c7ww		x_refsource_CONFIRMExploitMitigationVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-22693
https://www.cve.org/CVERecord?id=CVE-2026-22693