What’s Vulnerable › Products

harfbuzz vulnerabilities

10 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 4 published in the last 12 months.

Check whether your harfbuzz version is affected

Latest harfbuzz vulnerabilities

• CVE-2026-113680 — HarfBuzz 8.0.0 through 14.6.0 WebAssembly Shaper NULL Pointer Dereference DoS (CVSS 5.5)
• CVE-2026-113679 — HarfBuzz 8.0.0 through 14.6.0 Out-of-Bounds Write via WebAssembly font_glyph_to_string (CVSS 7.0)
• CVE-2026-22693 — Null Pointer Dereference in SubtableUnicodesCache::create leading to DoS (CVSS 5.3)
• CVE-2024-56732 — HarfBuzz heap-buffer-overflow on hb_cairo_glyphs_from_buffer (CVSS 8.8)
• CVE-2023-25193 — (CVSS 7.5)
• CVE-2022-33068 — (CVSS 5.5)
• CVE-2021-45931 — (CVSS 6.5)
• CVE-2015-9274 — (CVSS 6.5)
• CVE-2015-8947 — (CVSS 7.6)
• CVE-2016-2052 — (CVSS 7.6)