AIKIDO-2026-542525
harfbuzz.harfbuzz is vulnerable to Out-of-bounds Read
44
Medium Risk
This Affects:
harfbuzz.harfbuzzTL;DR
HarfBuzz's buffer addition functions such as hb_buffer_add_utf8 share a template that validates item_length is non-negative but never checks that item_offset does not exceed the input text length. When a caller supplies an out-of-range item_offset together with a zero item_length, the pre-context collection step computes and then dereferences a pointer past the end of the input buffer. This produces a heap buffer over-read of up to a few characters that can disclose adjacent heap memory or crash the process. The fix clamps item_offset and item_length to the valid text range before the buffer is accessed.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your application calls the buffer-add functions (such as hb_buffer_add_utf8) with an item_offset that can exceed the input text length.
Background info
harfbuzz.harfbuzz is vulnerable to Out-of-bounds Read in versions 0.9.5 - 13.2.1.
How to fix this
Upgrade the harfbuzz.harfbuzz library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant