CVE-2015-9274

Severity: medium (CVSS 6.5 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-11-15 · updated 2026-06-17
Weakness: CWE-125

Description

HarfBuzz before 1.0.4 allows remote attackers to cause a denial of service (invalid read of two bytes and application crash) because of GPOS and GSUB table mishandling, related to hb-ot-layout-gpos-table.hh, hb-ot-layout-gsub-table.hh, and hb-ot-layout-gsubgpos-private.hh.

Affected products

harfbuzz: before 1.0.4 — fixed in 1.0.4

How to fix

Upgrade to a fixed version: harfbuzz 1.0.4. Check the vendor advisory for mitigations.

References

https://github.com/harfbuzz/harfbuzz/commit/c917965b9e6fe2b21ed6c51559673288fa3af4b7
https://github.com/harfbuzz/harfbuzz/commit/c917965b9e6fe2b21ed6c51559673288fa3af4b7

Get alerted when CVE-2015-9274 or the next vulnerability affects your stack