CVE-2015-8947
HighSummary
HarfBuzz before version 1.0.5 contains a vulnerability that allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via crafted data.
Risk Assessment
Organizations may be exposed to attacks that lead to denial of service, affecting the availability of services relying on HarfBuzz.
Recommendation
It is recommended to update HarfBuzz to version 1.0.5 or later to mitigate this vulnerability.
Other vulnerabilities in HarfBuzz
See all- CVE-2026-113680Medium
HarfBuzz from 8.0.0 through 14.6.0 contains a NULL pointer dereference vulnerability in the experimental WebAssembly shaper host imports buffer_set_contents, face_create, and font_set_coords. A crafted font whose embedded wasm module passes out-of-range addresses with non-zero lengths crashes any application that shapes text with the font.
- CVE-2026-113679High
HarfBuzz 8.0.0 through 14.6.0 contains an out-of-bounds write in the experimental WebAssembly shaper due to a wrong WAMR signature for the font_glyph_to_string import. An attacker can supply a crafted font whose wasm module places the output buffer near the end of linear memory, writing glyph-name bytes into host memory and crashing or corrupting applications.
- CVE-2024-56732High
HarfBuzz is a text shaping engine. Starting with versions 8.5.0 through 10.0.1, there is a heap-based buffer overflow in the hb_cairo_glyphs_from_buffer function.
Original NVD description (English source)
hb-ot-layout-gpos-table.hh in HarfBuzz before 1.0.5 allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via crafted data, a different vulnerability than CVE-2016-2052.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS