CVE-2026-22693: 
NixOS vulnerability analysis and mitigation

CVE-2026-22693 is a NULL Pointer Dereference vulnerability (CWE-476) in HarfBuzz, an open-source text shaping engine, affecting all versions prior to 12.3.0. The flaw resides in the SubtableUnicodesCache::create function in src/hb-ot-cmap-table.hh (lines 1672–1673), where the return value of hb_malloc is not checked for NULL before placement new is invoked. It was disclosed on January 10, 2026, via a GitHub Security Advisory, with the fix committed shortly after. The vulnerability carries a CVSS v3.1 base score of 5.3 (Medium) (GitHub Advisory, Openwall OSS-Sec).

The root cause (CWE-476) is a missing NULL check on the return value of hb_malloc in OT::SubtableUnicodesCache::create(). When hb_malloc fails — due to low-memory conditions or a custom allocator (such as HarfBuzz's fuzzing failing-alloc.c, which returns NULL with 1/16 probability) — the code proceeds to invoke placement new on the NULL pointer, causing undefined behavior and a Segmentation Fault (SIGSEGV). The vulnerable call chain is: hb_subset_preprocess → hb_subset_or_fail → hb_subset_plan_execute_or_fail → _attach_accelerator_data → OT::cmap::create_filled_cache → SubtableUnicodesCache::create. The fix adds a single null check (if (unlikely (!cache)) return nullptr;) before the placement new call (GitHub Advisory, Patch Commit).

Successful exploitation results in a Denial of Service (DoS) via a Segmentation Fault in the HarfBuzz process. There is no impact on confidentiality or integrity — only availability is affected (CVSS availability impact: Low). Any application that uses HarfBuzz for font subsetting or text shaping and processes untrusted font inputs over a network could be crashed under low-memory conditions or with a custom allocator, potentially disrupting services that depend on font rendering (GitHub Advisory). Notably, a community researcher raised the question of whether this constitutes a genuine security vulnerability, arguing that triggering the bug requires either prior memory exhaustion or code execution (Openwall OSS-Sec).

A proof-of-concept (PoC) reproducer is publicly available in the HarfBuzz repository's test/fuzzing/repro.cc, along with a crash input file, and was disclosed as part of the GitHub Security Advisory (GitHub Advisory). The EPSS score is approximately 0.039% (very low), reflecting limited likelihood of active exploitation. There is no evidence of in-the-wild exploitation, no known threat actor attribution, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is network-accessible with no authentication or user interaction required, but practical exploitation depends on triggering memory allocation failure in the target process (Openwall OSS-Sec).

1. Identify target: Locate a network-accessible service that uses HarfBuzz versions prior to 12.3.0 for font subsetting or text shaping (e.g., a web service that processes user-supplied fonts).
2. Prepare malformed font input: Craft or obtain a font file that triggers the hb_subset_preprocess code path, invoking SubtableUnicodesCache::create. The PoC crash input is publicly referenced in the advisory.
3. Trigger memory pressure: Exploit the vulnerability under low-memory conditions on the target system, or in environments using a custom allocator that can return NULL (such as HarfBuzz's own fuzzing allocator failing-alloc.c).
4. Submit font to target: Send the crafted font input to the target service via the network. When hb_malloc returns NULL and placement new is called on the null pointer, a Segmentation Fault (SIGSEGV) occurs.
5. Achieve DoS: The process crashes, resulting in a denial of service for the affected application (GitHub Advisory, Openwall OSS-Sec).

• Logs: Application crash logs or core dumps referencing OT::SubtableUnicodesCache::SubtableUnicodesCache or hb-ot-cmap-table.hh:1692; AddressSanitizer output showing SEGV on unknown address 0x000000000000 with write access.
• Process: Unexpected termination of processes using HarfBuzz (e.g., font rendering services, PDF processors, browsers); SIGSEGV signals originating from the HarfBuzz library.
• Network: Repeated submission of font files or font-processing requests to a service, particularly with inputs that trigger the hb_subset_preprocess code path under memory-constrained conditions.
• File System: Presence of crash dump files (core dumps) in the working directory of the affected application, potentially containing stack traces referencing hb_subset_or_fail or SubtableUnicodesCache::create (GitHub Advisory).

Upgrade HarfBuzz to version 12.3.0 or later, which includes the fix adding a null pointer check in SubtableUnicodesCache::create (Patch Commit). If immediate patching is not feasible, restrict network access to services that process untrusted font inputs, and implement resource limits (e.g., memory limits) for font processing operations to reduce the likelihood of allocation failure. Downstream distributions including Fedora, Mageia, Amazon Linux 2, openSUSE, and others have issued updated packages incorporating the fix (GitHub Advisory).

The vulnerability was disclosed by researchers from HSPACE Knights Frontier (SSA Lab) and published via GitHub's security advisory system. On the oss-security mailing list, community member Jacob Bachmeyer questioned whether this constitutes a genuine security vulnerability, arguing that triggering the bug requires either prior memory exhaustion or code execution, and characterizing it as "a crash bug, but not a security issue" (Openwall OSS-Sec). Alan Coopersmith also noted a discrepancy in the CVE record, pointing out that the fix was merged weeks after the 12.3.0 release despite the CVE claiming the issue was patched in that version (Openwall OSS-Sec). Coverage has appeared on Linux security news sites and distribution security advisories, reflecting routine downstream patching activity.