CVE-2015-8947: hb-ot-layout-gpos-table.hh in HarfBuzz before 1.0.5 allows remote attackers to cause a denial of service (b...

Security readout for executives and security teams

HarfBuzz, a text shaping library, had a buffer over-read flaw before version 1.0.5. Maliciously crafted data could crash software that parses or renders it. The public record does not provide CVSS scoring or confirm broader impact beyond possible unspecified effects. Exposure is most likely where old HarfBuzz libraries are used directly or bundled into applications that process untrusted fonts, documents, webpages, or graphical content. Distro packages may be fixed even if their version string differs. Treat this as a maintenance-priority denial-of-service risk, not an emergency absent exposure to untrusted content or vendor evidence of exploitation. Remediate through normal patch cycles, with faster handling for internet-facing or file-processing services. Mitigation focus: Apply vendor security updates for HarfBuzz packages on affected distributions.; Upgrade HarfBuzz to 1.0.5 or a vendor-fixed package.; Identify applications that statically bundle HarfBuzz and update them separately..

Prepared

Jun 13, 2026, 14:00 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.