Harfbuzz vulnerabilities
We track 2 vulnerabilities in Harfbuzz products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on October 20, 2026.
2vulnerabilities
1critical
1high
0exploited
8.2average CVSS score
Latest Harfbuzz vulnerabilities
- 7.0 High severity
harfbuzz: Out-of-bounds Write
HarfBuzz 8.0.0 through 14.6.0 contains an out-of-bounds write vulnerability in the experimental WebAssembly shaper because the font_glyph_to_string import has a wrong WAMR signature. Attackers can supply a crafted font whose wasm module places the output buffe
- 9.3 Critical severity
harfbuzz: Heap-based Buffer Overflow
HarfBuzz is a text shaping engine. Starting with 8.5.0 through 10.0.1, there is a heap-based buffer overflow in the hb_cairo_glyphs_from_buffer function.