Description
HarfBuzz::Shaper versions before 0.032 for Perl contains a bundled library with a null pointer dereference vulnerability. Versions before 0.032 contain HarfBuzz 8.4.0 or earlier bundled as hb_src.tar.gz in the source tarball, which is affected by CVE-2026-22693.
References (3)
Core 3
Core References
Issue Tracking issue-tracking
https://bugzilla.redhat.com/show_bug.cgi?id=2429296
Various Sources
https://www.cve.org/CVERecord?id=CVE-2026-22693
Release Notes release-notes
https://metacpan.org/release/JV/HarfBuzz-Shaper-0.032/changes
Scores
CVSS v3
7.5
EPSS
0.0042
EPSS Percentile
33.7%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
yes
Technical Impact
partial
Details
CWE
CWE-476
Status
published
Products (1)
jv/harfbuzz\
< 0.032
Published
Jan 19, 2026
Tracked Since
Feb 18, 2026