SB2026081983 - Out-of-bounds read in HarfBuzz

Description

This security bulletin contains information about 1 vulnerability.

1) Out-of-bounds read (CVE-ID: N/A)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information and cause a denial of service.

The vulnerability exists due to out-of-bounds read in hb_buffer_add_utf() when processing caller-supplied text buffers with an item_offset greater than text_length and an explicit item_length of 0. A local user can supply crafted item_offset and item_length values to disclose sensitive information and cause a denial of service.

The issue occurs during the pre-context collection phase and affects the public APIs hb_buffer_add_utf8(), hb_buffer_add_utf16(), hb_buffer_add_utf32(), and hb_buffer_add_latin1().

Remediation

Install update from vendor's website.

References

• https://github.com/harfbuzz/harfbuzz/security/advisories/GHSA-q4gc-p4hh-3765
• https://github.com/harfbuzz/harfbuzz/pull/5864/commits/c34dd6e24bd76591e423807616b2b8412d4a5df1