HarfBuzz before 1.0.4 allows remote attackers to cause a denial of service (invalid read of two bytes and application crash) because of GPOS and GSUB table mishandling, related to hb-ot-layout-gpos-table.hh, hb-ot-layout-gsub-table.hh, and hb-ot-layout-gsubgpos-private.hh.
so Is there any public bug that I can look? Is there any fix really needed?
I am removing myself as I think this bug should have closed actually as all the releases have given their resolution already. There is nothing should be remained to take action for this CVE.