CVE-2026-0943

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-0943", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "state": "PUBLISHED", "assignerShortName": "CPANSec", "dateReserved": "2026-01-14T15:30:04.686Z", "datePublished": "2026-01-19T02:46:52.012Z", "dateUpdated": "2026-01-20T15:25:23.530Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "packageName": "HarfBuzz-Shaper", "product": "HarfBuzz::Shaper", "programFiles": ["hb_src.tar.gz"], "repo": "https://github.com/sciurius/perl-HarfBuzz-Shaper", "vendor": "JV", "versions": [{"lessThan": "0.032", "status": "affected", "version": "0", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>HarfBuzz::Shaper versions before 0.032 for Perl contains a bundled library with a null pointer dereference vulnerability.&nbsp;</p>Versions before 0.032 contain HarfBuzz 8.4.0 or earlier bundled as hb_src.tar.gz in the source tarball, which is affected by CVE-2026-22693."}], "value": "HarfBuzz::Shaper versions before 0.032 for Perl contains a bundled library with a null pointer dereference vulnerability.\u00a0\n\nVersions before 0.032 contain HarfBuzz 8.4.0 or earlier bundled as hb_src.tar.gz in the source tarball, which is affected by CVE-2026-22693."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-1395", "description": "CWE-1395 Dependency on Vulnerable Third-Party Component", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "shortName": "CPANSec", "dateUpdated": "2026-01-19T02:54:06.255Z"}, "references": [{"tags": ["issue-tracking"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2429296"}, {"url": "https://www.cve.org/CVERecord?id=CVE-2026-22693"}, {"tags": ["release-notes"], "url": "https://metacpan.org/release/JV/HarfBuzz-Shaper-0.032/changes"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Users should update to version 0.032 or later, where the bundled HarfBuzz library was updated to version 12.3.0."}], "value": "Users should update to version 0.032 or later, where the bundled HarfBuzz library was updated to version 12.3.0."}], "source": {"discovery": "UNKNOWN"}, "title": "HarfBuzz::Shaper versions before 0.032 for Perl contains a bundled library with a null pointer dereference vulnerability", "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-01-20T15:23:35.724880Z", "id": "CVE-2026-0943", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-20T15:25:23.530Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-0943", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-20T15:23:35.724880Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-20T15:25:16.195Z"}}], "cna": {"title": "HarfBuzz::Shaper versions before 0.032 for Perl contains a bundled library with a null pointer dereference vulnerability", "source": {"discovery": "UNKNOWN"}, "affected": [{"repo": "https://github.com/sciurius/perl-HarfBuzz-Shaper", "vendor": "JV", "product": "HarfBuzz::Shaper", "versions": [{"status": "affected", "version": "0", "lessThan": "0.032", "versionType": "custom"}], "packageName": "HarfBuzz-Shaper", "programFiles": ["hb_src.tar.gz"], "collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Users should update to version 0.032 or later, where the bundled HarfBuzz library was updated to version 12.3.0.", "supportingMedia": [{"type": "text/html", "value": "Users should update to version 0.032 or later, where the bundled HarfBuzz library was updated to version 12.3.0.", "base64": false}]}], "references": [{"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2429296", "tags": ["issue-tracking"]}, {"url": "https://www.cve.org/CVERecord?id=CVE-2026-22693"}, {"url": "https://metacpan.org/release/JV/HarfBuzz-Shaper-0.032/changes", "tags": ["release-notes"]}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "HarfBuzz::Shaper versions before 0.032 for Perl contains a bundled library with a null pointer dereference vulnerability.\u00a0\n\nVersions before 0.032 contain HarfBuzz 8.4.0 or earlier bundled as hb_src.tar.gz in the source tarball, which is affected by CVE-2026-22693.", "supportingMedia": [{"type": "text/html", "value": "<p>HarfBuzz::Shaper versions before 0.032 for Perl contains a bundled library with a null pointer dereference vulnerability.&nbsp;</p>Versions before 0.032 contain HarfBuzz 8.4.0 or earlier bundled as hb_src.tar.gz in the source tarball, which is affected by CVE-2026-22693.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1395", "description": "CWE-1395 Dependency on Vulnerable Third-Party Component"}]}], "providerMetadata": {"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "shortName": "CPANSec", "dateUpdated": "2026-01-19T02:54:06.255Z"}}}, "cveMetadata": {"cveId": "CVE-2026-0943", "state": "PUBLISHED", "dateUpdated": "2026-01-20T15:25:23.530Z", "dateReserved": "2026-01-14T15:30:04.686Z", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "datePublished": "2026-01-19T02:46:52.012Z", "assignerShortName": "CPANSec"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "packageName": "HarfBuzz-Shaper", "product": "HarfBuzz::Shaper", "programFiles": ["hb_src.tar.gz"], "repo": "https://github.com/sciurius/perl-HarfBuzz-Shaper", "vendor": "JV", "versions": [{"lessThan": "0.032", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:jv:harfbuzz\\:\\:shaper:*:*:*:*:*:perl:*:*", "matchCriteriaId": "9A596B45-7207-4CBE-9E42-6133EDAA5AD5", "versionEndExcluding": "0.032", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "HarfBuzz::Shaper versions before 0.032 for Perl contains a bundled library with a null pointer dereference vulnerability.\u00a0\n\nVersions before 0.032 contain HarfBuzz 8.4.0 or earlier bundled as hb_src.tar.gz in the source tarball, which is affected by CVE-2026-22693."}, {"lang": "es", "value": "Versiones de HarfBuzz::Shaper anteriores a la 0.032 para Perl contienen una librer\u00eda incluida con una vulnerabilidad de desreferencia de puntero nulo.\n\nLas versiones anteriores a la 0.032 contienen HarfBuzz 8.4.0 o anterior incluido como hb_src.tar.gz en el tarball de origen, el cual est\u00e1 afectado por CVE-2026-22693."}], "id": "CVE-2026-0943", "lastModified": "2026-06-17T10:11:39.690", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-0943", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-20T15:23:35.724880Z", "version": "2.0.3"}}]}, "published": "2026-01-19T04:15:58.710", "references": [{"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "tags": ["Third Party Advisory"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2429296"}, {"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "tags": ["Product", "Release Notes"], "url": "https://metacpan.org/release/JV/HarfBuzz-Shaper-0.032/changes"}, {"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://www.cve.org/CVERecord?id=CVE-2026-22693"}], "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-476"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T15:56:55.311977+00:00", "value": {"mitigation_remediation": ["Upgrade the Perl module to version 0.032 or later, which replaces the bundled HarfBuzz library with a fixed version.", "Remove any remaining hb_src.tar.gz archives from the Perl include path to ensure the module does not reference the old vulnerable library.", "Verify that the application operates correctly after the update by performing text rendering tests and monitoring for segmentation faults or crashes."], "summary": {"action": "Immediate Patch", "impact": "Denial of Service"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the JV Harfbuzz::Shaper Perl module for versions prior to 0.032. Vendors include JV, and the product is distributed via CPAN as Harfbuzz::Shaper. Systems running any of the bundled HarfBuzz 8.4.0 or earlier libraries inside the module are impacted; this includes all installations where the Perl module is imported or executed. Version information from the CNA indicates that upgrades to 0.032 or later replace the bundled library with HarfBuzz 12.3.0, which removes the fault.", "description_and_impact": "Harfbuzz::Shaper versions before 0.032 for Perl embed the HarfBuzz 8.4.0 or earlier source package, which is affected by a null pointer dereference vulnerability (CWE-476). The flaw can cause a segmentation fault when the library processes certain input, leading to a crash of the Perl process that ingests the module. The impact is primarily a denial of service, as the crash can terminate user\u2011processes or web services that rely on the module. No direct remote code execution path is described in the CVE data. The attack vector is inferred to be via legitimate use of the vulnerable Perl module, potentially triggered by crafted text rendering requests.", "risk_and_exploitability": "The CVSS score of 7.5 reflects a high severity impact. The EPSS score of less than 1 percent indicates a very low likelihood of exploitation in the wild at this time, and the vulnerability is not currently listed in CISA\u2019s KEV catalog. The primary exploitation pathway is server or application crash when the module processes a user\u2011supplied input that triggers the null dereference. Because exploitation requires the module to be executed in the attacker\u2019s context, the risk to systems that simply keep the module installed but do not load it is lower. Nonetheless, the high severity rating recommends remediation."}}}}, "created": "2026-01-19T09:18:45.976839+00:00", "updated": "2026-04-18T16:00:04.290933+00:00", "vendors": ["harfbuzz_project", "harfbuzz_project$PRODUCT$harfbuzz"]}