AIKIDO-2026-10080
harfbuzz.harfbuzz is vulnerable to NULL Pointer Dereference
53
Medium Risk
This Affects:
harfbuzz.harfbuzzTL;DR
Affected versions of this package lack proper handling of memory allocation failures in the cmap subtable Unicode cache path, which could lead to a denial of service due to crashes or undefined behavior when allocation fails. The patched version adds a test to verify correct behavior when hb_malloc fails, ensuring graceful failure handling.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
harfbuzz.harfbuzz is vulnerable to NULL Pointer Dereference in versions 6.0.0 - 12.3.0.
How to fix this
Upgrade the harfbuzz.harfbuzz library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant