← All advisories

High severity7.5OSV Advisory· Published Jan 19, 2026· Updated Jun 17, 2026

CVE-2026-0943

CVE-2026-0943

Description

HarfBuzz::Shaper versions before 0.032 for Perl contains a bundled library with a null pointer dereference vulnerability.

Versions before 0.032 contain HarfBuzz 8.4.0 or earlier bundled as hb_src.tar.gz in the source tarball, which is affected by CVE-2026-22693.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

3

Sciurius/Perl Harfbuzz ShaperOSV
Range: R0.001, R0.011, R0.012, …
Jv/Harfbuzz\
cpe:2.3:a:jv:harfbuzz\:\:shaper:*:*:*:*:*:perl:*:*
Range: <0.032
Perl Foundation/HarfBuzz::Shaperllm-create
Range: <0.032

Patches

Vulnerability mechanics

References

3

bugzilla.redhat.com/show_bug.cginvdThird Party Advisory
www.cve.org/CVERecordnvdThird Party AdvisoryVDB Entry
metacpan.org/release/JV/HarfBuzz-Shaper-0.032/changesnvdProductRelease Notes

News mentions

0

No linked articles in our index yet.