CVE-2024-56732

HighCVSS 8.8

Published: 27/12/2024(UTC)Updated: 25/06/2026(UTC)Translated: 26/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.50%

39th percentile - higher than 39% of all known CVEs

Summary

HarfBuzz is a text shaping engine. Starting with versions 8.5.0 through 10.0.1, there is a heap-based buffer overflow in the hb_cairo_glyphs_from_buffer function.

Risk Assessment

The buffer overflow may lead to arbitrary code execution, posing a significant security risk to applications using HarfBuzz.

Recommendation

It is recommended to update HarfBuzz to the latest version to mitigate this vulnerability.

Other vulnerabilities in HarfBuzz

CVE-2015-8947High
HarfBuzz before version 1.0.5 contains a vulnerability that allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via crafted data.

Original NVD description (English source)

HarfBuzz is a text shaping engine. Starting with 8.5.0 through 10.0.1, there is a heap-based buffer overflow in the hb_cairo_glyphs_from_buffer function.