Security readout for executives and security teams
Plain-English summary
HarfBuzz, a common text-shaping library, can be forced into excessive processing when handling certain sequences of glyph marks. The documented impact is availability only: an affected application may slow down or become unavailable. The CVSS vector indicates remote, unauthenticated triggering is possible, but the bundle does not identify active exploitation.
Executive priority
Treat as a high-priority availability risk, especially for services that render untrusted content at scale. There is no source-backed evidence of active exploitation here, so prioritize normal patch management with focus on exposed rendering pipelines and vendor-supported updates.
Technical view
CVE-2023-25193 affects hb-ot-layout-gsubgpos.hh in HarfBuzz through 6.0.0. Consecutive marks can cause O(n^2) growth while looking back for base glyphs during mark attachment. The issue maps to CWE-770 and has CVSS 3.1 score 7.5 for high availability impact.
Likely exposure
Exposure is most likely in systems that include HarfBuzz through 6.0.0 or vendor packages derived from it. The bundle lists Fedora and NetApp advisories and a Chromium dependency reference, but does not provide a complete product inventory.
Exploitation context
The source bundle does not show CISA KEV listing or cited evidence of active exploitation. The CVSS vector says exploitation can be network-reachable, low-complexity, unauthenticated, and without user interaction, with impact limited to availability.
Researcher notes
The key behavior is algorithmic complexity growth in GSUB/GPOS mark attachment lookup. Affected product data in the bundle is incomplete, so validation should focus on dependency discovery and vendor package status rather than assuming specific downstream exposure.
Mitigation direction
- Identify HarfBuzz versions in operating systems, containers, browsers, and bundled application dependencies.
- Upgrade HarfBuzz to a vendor-patched build or a release containing the upstream fix.
- Apply relevant Fedora or NetApp vendor updates where those products are in scope.
- Check Chromium or other vendored dependency pins for inclusion of the referenced HarfBuzz fix.
- Prioritize internet-facing services that process untrusted fonts, documents, or rendered text.
Validation and detection
- Confirm deployed HarfBuzz package versions and compare them against vendor advisories.
- Review software bills of materials for statically bundled HarfBuzz copies.
- Verify patched packages include or supersede the referenced upstream commit.
- Check service monitoring for abnormal CPU spikes during text or document processing.
- Document any exposed text-rendering paths that accept untrusted remote content.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-770: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2023-25193 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H3.93.6Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
7.5HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/harfbuzz/harfbuzz/commit/85be877925ddbf34f74a1229f3ca1716bb6170dcCVE reference
- https://chromium.googlesource.com/chromium/src/+/e1f324aa681af54101c1f2d173d92adb80e37088/DEPS#361CVE reference
- https://github.com/harfbuzz/harfbuzz/blob/2822b589bc837fae6f66233e2cf2eef0f6ce8470/src/hb-ot-layout-gsubgpos.hhCVE reference
- FEDORA-2023-4e6353c6f7CVE reference · vendor-advisory
- FEDORA-2023-a48406ecd2CVE reference · vendor-advisory
- https://security.netapp.com/advisory/ntap-20230725-0006/CVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Allocation of Resources Without Limits or Throttling
Allocation of Resources Without Limits or Throttling represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.