Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
https://src.fedoraproject.org/rpms/harfbuzz/pull-request/11
Well there is no information at all in this bug or parent bug about what this CVE is and how to reproduce it and what its severity is....
(In reply to Parag Nemade from comment #2) > Well there is no information at all in this bug or parent bug about what > this CVE is and how to reproduce it and what its severity is.... I agree, these bugs are horribly unhelpful. I ended up looking at this because I had bugs filed on python-uharfbuzz, apparently just because it has “harfbuzz” in the name. It removes the bundled harfbuzz in %prep and builds against the system harfbuzz, so there’s nothing to be done in python-uharfbuzz. That kind of sloppy targeting on these reports is also unhelpful. Looking up CVE-2026-22693 in cve.org leads to https://www.cve.org/CVERecord?id=CVE-2026-22693, and that leads to https://github.com/harfbuzz/harfbuzz/security/advisories/GHSA-xvjr-f2r9-c7ww, which has a reasonable amount of detail. (These links should be in the bugs to start with!) This kind of bug (a null-pointer dereference after a memory-allocation failure resulting in undefined behaviour) doesn’t seem likely to have much impact in practice in hosted environments where virtual memory overcommit is enabled and most applications aren’t prepared to handle allocation failures gracefully. Sure, absolutely anything can happen once undefined behavior comes into play, but in this case there doesn’t seem to be much room for anything other than a null pointer dereference and ensuing program termination. Then again, the fix https://github.com/harfbuzz/harfbuzz/commit/1265ff8d990284f04d8768f35b0e20ae5f60daae was very straightforward and trivial to backport, so I figured, why not open PRs?
Ben, Your contribution is always welcome and helpful to Fedora. Just that these Security people don't do their work fully while reporting CVE bugs.
FEDORA-2026-bac983cf83 (harfbuzz-10.4.0-2.fc42) has been submitted as an update to Fedora 42. https://bodhi.fedoraproject.org/updates/FEDORA-2026-bac983cf83
FEDORA-2026-bac983cf83 has been pushed to the Fedora 42 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-bac983cf83` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-bac983cf83 See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.