Back Linuxsecurity

Fedora 43: HarfBuzz Important Null Pointer Fix CVE-2026

Linuxsecurity •LinuxSecurity Advisories • January 16, 2026

HarfBuzz is an implementation of the OpenType Layout engine. Update Information : Backport security fix for CVE-2026-22693 (fix RHBZ#2429288)

HarfBuzz is an implementation of the OpenType Layout engine.

Backport security fix for CVE-2026-22693 (fix RHBZ#2429288)

* Wed Jan 14 2026 Parag Nemade - 11.5.1-2 - Backport security fix for CVE-2026-22693 (fix RHBZ#2429288)

[ 1 ] Bug #2429288 - CVE-2026-22693 harfbuzz: Null Pointer Dereference in harfbuzz [fedora-43]

This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-b38fe572ef' at the command line. For more information, refer to the dnf documentation available at

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Null Pointer Issue in HarfBuzz Affects Fedora 42 and 43 A critical null pointer dereference vulnerability, identified as CVE-2026-22693, affects the HarfBuzz implementation in Fedora 42 and 43. Backport patches have been released to address this issue, with Fedora 42 receiving its update on January 17, 2026, and Fedora 43 on January 14, 2026. 3 sources 37

Extracted Entities

Companies (1)

Fedora

CVEs (1)

CVE-2026-22693