{
  "document": {
    "aggregate_severity": {
      "text": "Medium"
    },
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "distribution": {
      "text": "TuxCare License Agreement",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://tuxcare.com/contact/",
      "name": "TuxCare",
      "namespace": "https://tuxcare.com/"
    },
    "references": [
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.tuxcare.com/csaf/v2/els_os/cloudlinux7els/vex/2026/cve-2026-22693-els_os-cloudlinux7els.json"
      }
    ],
    "tracking": {
      "current_release_date": "2026-10-25T04:20:39Z",
      "generator": {
        "date": "2026-10-25T04:20:39Z",
        "engine": {
          "name": "pyCSAF"
        }
      },
      "id": "CVE-2026-22693-ELS_OS-CLOUDLINUX7ELS",
      "initial_release_date": "2026-01-10T06:15:00Z",
      "revision_history": [
        {
          "date": "2026-01-10T06:15:00Z",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-10-25T04:20:39Z",
          "number": "2",
          "summary": "Official Publication"
        }
      ],
      "status": "final",
      "version": "2"
    },
    "title": "Security update on CVE-2026-22693"
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "CloudLinux 7",
                "product": {
                  "name": "CloudLinux 7",
                  "product_id": "CloudLinux-7",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:o:cloudlinux:cloudlinux:7:*:*:*:*:*:*:*"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "CloudLinux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "harfbuzz-icu-0:1.7.5-2.el7.i686",
                "product": {
                  "name": "harfbuzz-icu-0:1.7.5-2.el7.i686",
                  "product_id": "harfbuzz-icu-0:1.7.5-2.el7.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/cloudlinux/harfbuzz-icu@1.7.5-2.el7?arch=i686"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "harfbuzz-0:1.7.5-2.el7.i686",
                "product": {
                  "name": "harfbuzz-0:1.7.5-2.el7.i686",
                  "product_id": "harfbuzz-0:1.7.5-2.el7.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/cloudlinux/harfbuzz@1.7.5-2.el7?arch=i686"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "harfbuzz-devel-0:1.7.5-2.el7.i686",
                "product": {
                  "name": "harfbuzz-devel-0:1.7.5-2.el7.i686",
                  "product_id": "harfbuzz-devel-0:1.7.5-2.el7.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/cloudlinux/harfbuzz-devel@1.7.5-2.el7?arch=i686"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "i686"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "harfbuzz-icu-0:1.7.5-2.el7.x86_64",
                "product": {
                  "name": "harfbuzz-icu-0:1.7.5-2.el7.x86_64",
                  "product_id": "harfbuzz-icu-0:1.7.5-2.el7.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/cloudlinux/harfbuzz-icu@1.7.5-2.el7?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "harfbuzz-0:1.7.5-2.el7.x86_64",
                "product": {
                  "name": "harfbuzz-0:1.7.5-2.el7.x86_64",
                  "product_id": "harfbuzz-0:1.7.5-2.el7.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/cloudlinux/harfbuzz@1.7.5-2.el7?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "harfbuzz-devel-0:1.7.5-2.el7.x86_64",
                "product": {
                  "name": "harfbuzz-devel-0:1.7.5-2.el7.x86_64",
                  "product_id": "harfbuzz-devel-0:1.7.5-2.el7.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/cloudlinux/harfbuzz-devel@1.7.5-2.el7?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "Cloud Linux Software, Inc."
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "harfbuzz-icu-0:1.7.5-2.el7.tuxcare.els1.i686",
                "product": {
                  "name": "harfbuzz-icu-0:1.7.5-2.el7.tuxcare.els1.i686",
                  "product_id": "harfbuzz-icu-0:1.7.5-2.el7.tuxcare.els1.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/cloudlinux/harfbuzz-icu@1.7.5-2.el7.tuxcare.els1?arch=i686"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "harfbuzz-0:1.7.5-2.el7.tuxcare.els1.i686",
                "product": {
                  "name": "harfbuzz-0:1.7.5-2.el7.tuxcare.els1.i686",
                  "product_id": "harfbuzz-0:1.7.5-2.el7.tuxcare.els1.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/cloudlinux/harfbuzz@1.7.5-2.el7.tuxcare.els1?arch=i686"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "harfbuzz-devel-0:1.7.5-2.el7.tuxcare.els1.i686",
                "product": {
                  "name": "harfbuzz-devel-0:1.7.5-2.el7.tuxcare.els1.i686",
                  "product_id": "harfbuzz-devel-0:1.7.5-2.el7.tuxcare.els1.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/cloudlinux/harfbuzz-devel@1.7.5-2.el7.tuxcare.els1?arch=i686"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "i686"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "harfbuzz-icu-0:1.7.5-2.el7.tuxcare.els1.x86_64",
                "product": {
                  "name": "harfbuzz-icu-0:1.7.5-2.el7.tuxcare.els1.x86_64",
                  "product_id": "harfbuzz-icu-0:1.7.5-2.el7.tuxcare.els1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/cloudlinux/harfbuzz-icu@1.7.5-2.el7.tuxcare.els1?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "harfbuzz-0:1.7.5-2.el7.tuxcare.els1.x86_64",
                "product": {
                  "name": "harfbuzz-0:1.7.5-2.el7.tuxcare.els1.x86_64",
                  "product_id": "harfbuzz-0:1.7.5-2.el7.tuxcare.els1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/cloudlinux/harfbuzz@1.7.5-2.el7.tuxcare.els1?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "harfbuzz-devel-0:1.7.5-2.el7.tuxcare.els1.x86_64",
                "product": {
                  "name": "harfbuzz-devel-0:1.7.5-2.el7.tuxcare.els1.x86_64",
                  "product_id": "harfbuzz-devel-0:1.7.5-2.el7.tuxcare.els1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/cloudlinux/harfbuzz-devel@1.7.5-2.el7.tuxcare.els1?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "CloudLinux"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "harfbuzz-icu-0:1.7.5-2.el7.tuxcare.els1.i686 as a component of CloudLinux 7",
          "product_id": "CloudLinux-7:harfbuzz-icu-0:1.7.5-2.el7.tuxcare.els1.i686"
        },
        "product_reference": "harfbuzz-icu-0:1.7.5-2.el7.tuxcare.els1.i686",
        "relates_to_product_reference": "CloudLinux-7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "harfbuzz-icu-0:1.7.5-2.el7.i686 as a component of CloudLinux 7",
          "product_id": "CloudLinux-7:harfbuzz-icu-0:1.7.5-2.el7.i686"
        },
        "product_reference": "harfbuzz-icu-0:1.7.5-2.el7.i686",
        "relates_to_product_reference": "CloudLinux-7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "harfbuzz-icu-0:1.7.5-2.el7.tuxcare.els1.x86_64 as a component of CloudLinux 7",
          "product_id": "CloudLinux-7:harfbuzz-icu-0:1.7.5-2.el7.tuxcare.els1.x86_64"
        },
        "product_reference": "harfbuzz-icu-0:1.7.5-2.el7.tuxcare.els1.x86_64",
        "relates_to_product_reference": "CloudLinux-7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "harfbuzz-icu-0:1.7.5-2.el7.x86_64 as a component of CloudLinux 7",
          "product_id": "CloudLinux-7:harfbuzz-icu-0:1.7.5-2.el7.x86_64"
        },
        "product_reference": "harfbuzz-icu-0:1.7.5-2.el7.x86_64",
        "relates_to_product_reference": "CloudLinux-7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "harfbuzz-0:1.7.5-2.el7.tuxcare.els1.i686 as a component of CloudLinux 7",
          "product_id": "CloudLinux-7:harfbuzz-0:1.7.5-2.el7.tuxcare.els1.i686"
        },
        "product_reference": "harfbuzz-0:1.7.5-2.el7.tuxcare.els1.i686",
        "relates_to_product_reference": "CloudLinux-7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "harfbuzz-0:1.7.5-2.el7.i686 as a component of CloudLinux 7",
          "product_id": "CloudLinux-7:harfbuzz-0:1.7.5-2.el7.i686"
        },
        "product_reference": "harfbuzz-0:1.7.5-2.el7.i686",
        "relates_to_product_reference": "CloudLinux-7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "harfbuzz-0:1.7.5-2.el7.tuxcare.els1.x86_64 as a component of CloudLinux 7",
          "product_id": "CloudLinux-7:harfbuzz-0:1.7.5-2.el7.tuxcare.els1.x86_64"
        },
        "product_reference": "harfbuzz-0:1.7.5-2.el7.tuxcare.els1.x86_64",
        "relates_to_product_reference": "CloudLinux-7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "harfbuzz-0:1.7.5-2.el7.x86_64 as a component of CloudLinux 7",
          "product_id": "CloudLinux-7:harfbuzz-0:1.7.5-2.el7.x86_64"
        },
        "product_reference": "harfbuzz-0:1.7.5-2.el7.x86_64",
        "relates_to_product_reference": "CloudLinux-7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "harfbuzz-devel-0:1.7.5-2.el7.tuxcare.els1.x86_64 as a component of CloudLinux 7",
          "product_id": "CloudLinux-7:harfbuzz-devel-0:1.7.5-2.el7.tuxcare.els1.x86_64"
        },
        "product_reference": "harfbuzz-devel-0:1.7.5-2.el7.tuxcare.els1.x86_64",
        "relates_to_product_reference": "CloudLinux-7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "harfbuzz-devel-0:1.7.5-2.el7.x86_64 as a component of CloudLinux 7",
          "product_id": "CloudLinux-7:harfbuzz-devel-0:1.7.5-2.el7.x86_64"
        },
        "product_reference": "harfbuzz-devel-0:1.7.5-2.el7.x86_64",
        "relates_to_product_reference": "CloudLinux-7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "harfbuzz-devel-0:1.7.5-2.el7.tuxcare.els1.i686 as a component of CloudLinux 7",
          "product_id": "CloudLinux-7:harfbuzz-devel-0:1.7.5-2.el7.tuxcare.els1.i686"
        },
        "product_reference": "harfbuzz-devel-0:1.7.5-2.el7.tuxcare.els1.i686",
        "relates_to_product_reference": "CloudLinux-7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "harfbuzz-devel-0:1.7.5-2.el7.i686 as a component of CloudLinux 7",
          "product_id": "CloudLinux-7:harfbuzz-devel-0:1.7.5-2.el7.i686"
        },
        "product_reference": "harfbuzz-devel-0:1.7.5-2.el7.i686",
        "relates_to_product_reference": "CloudLinux-7"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-22693",
      "cwe": {
        "id": "CWE-476",
        "name": "NULL Pointer Dereference"
      },
      "notes": [
        {
          "category": "description",
          "text": "HarfBuzz is a text shaping engine. Prior to version 12.3.0, a null pointer dereference vulnerability exists in the SubtableUnicodesCache::create function located in src/hb-ot-cmap-table.hh. The function fails to check if hb_malloc returns NULL before using placement new to construct an object at the returned pointer address. When hb_malloc fails to allocate memory (which can occur in low-memory conditions or when using custom allocators that simulate allocation failures), it returns NULL. The code then attempts to call the constructor on this null pointer using placement new syntax, resulting in undefined behavior and a Segmentation Fault. This issue has been patched in version 12.3.0.",
          "title": "Vulnerability description"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "known_affected": [
          "CloudLinux-7:harfbuzz-0:1.7.5-2.el7.i686",
          "CloudLinux-7:harfbuzz-0:1.7.5-2.el7.tuxcare.els1.i686",
          "CloudLinux-7:harfbuzz-0:1.7.5-2.el7.tuxcare.els1.x86_64",
          "CloudLinux-7:harfbuzz-0:1.7.5-2.el7.x86_64",
          "CloudLinux-7:harfbuzz-devel-0:1.7.5-2.el7.i686",
          "CloudLinux-7:harfbuzz-devel-0:1.7.5-2.el7.tuxcare.els1.i686",
          "CloudLinux-7:harfbuzz-devel-0:1.7.5-2.el7.tuxcare.els1.x86_64",
          "CloudLinux-7:harfbuzz-devel-0:1.7.5-2.el7.x86_64",
          "CloudLinux-7:harfbuzz-icu-0:1.7.5-2.el7.i686",
          "CloudLinux-7:harfbuzz-icu-0:1.7.5-2.el7.tuxcare.els1.i686",
          "CloudLinux-7:harfbuzz-icu-0:1.7.5-2.el7.tuxcare.els1.x86_64",
          "CloudLinux-7:harfbuzz-icu-0:1.7.5-2.el7.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://cve.tuxcare.com/els/cve/CVE-2026-22693"
        },
        {
          "category": "external",
          "summary": "https://github.com/harfbuzz/harfbuzz/commit/1265ff8d990284f04d8768f35b0e20ae5f60daae",
          "url": "https://github.com/harfbuzz/harfbuzz/commit/1265ff8d990284f04d8768f35b0e20ae5f60daae"
        },
        {
          "category": "external",
          "summary": "https://github.com/harfbuzz/harfbuzz/security/advisories/GHSA-xvjr-f2r9-c7ww",
          "url": "https://github.com/harfbuzz/harfbuzz/security/advisories/GHSA-xvjr-f2r9-c7ww"
        },
        {
          "category": "external",
          "summary": "http://www.openwall.com/lists/oss-security/2026/01/11/1",
          "url": "http://www.openwall.com/lists/oss-security/2026/01/11/1"
        },
        {
          "category": "external",
          "summary": "http://www.openwall.com/lists/oss-security/2026/01/12/1",
          "url": "http://www.openwall.com/lists/oss-security/2026/01/12/1"
        }
      ],
      "release_date": "2026-01-10T06:15:00Z",
      "remediations": [
        {
          "category": "no_fix_planned",
          "date": "2026-10-15T12:41:20.261596Z",
          "details": "This flaw is a null-pointer dereference on allocation failure in a non-privileged, user‑space text‑shaping path, so the impact is limited to crashing the HarfBuzz-using process with no confidentiality or integrity risk and no route to code execution or privilege escalation. Triggering it reliably requires forcing hb_malloc to return NULL at a specific point (e.g., extreme low‑memory or custom allocators), which an external attacker cannot deterministically achieve via network input; at best it contributes to a generic resource‑exhaustion DoS unrelated to this specific bug. In managed enterprise VM/server contexts where HarfBuzz is invoked by application‑level rendering or document‑processing components rather than privileged, network‑exposed services, a crash of that worker process is confined to the application, making this issue low priority.",
          "product_ids": [
            "CloudLinux-7:harfbuzz-0:1.7.5-2.el7.i686",
            "CloudLinux-7:harfbuzz-0:1.7.5-2.el7.tuxcare.els1.i686",
            "CloudLinux-7:harfbuzz-0:1.7.5-2.el7.tuxcare.els1.x86_64",
            "CloudLinux-7:harfbuzz-0:1.7.5-2.el7.x86_64",
            "CloudLinux-7:harfbuzz-devel-0:1.7.5-2.el7.i686",
            "CloudLinux-7:harfbuzz-devel-0:1.7.5-2.el7.tuxcare.els1.i686",
            "CloudLinux-7:harfbuzz-devel-0:1.7.5-2.el7.tuxcare.els1.x86_64",
            "CloudLinux-7:harfbuzz-devel-0:1.7.5-2.el7.x86_64",
            "CloudLinux-7:harfbuzz-icu-0:1.7.5-2.el7.i686",
            "CloudLinux-7:harfbuzz-icu-0:1.7.5-2.el7.tuxcare.els1.i686",
            "CloudLinux-7:harfbuzz-icu-0:1.7.5-2.el7.tuxcare.els1.x86_64",
            "CloudLinux-7:harfbuzz-icu-0:1.7.5-2.el7.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "CloudLinux-7:harfbuzz-0:1.7.5-2.el7.i686",
            "CloudLinux-7:harfbuzz-0:1.7.5-2.el7.tuxcare.els1.i686",
            "CloudLinux-7:harfbuzz-0:1.7.5-2.el7.tuxcare.els1.x86_64",
            "CloudLinux-7:harfbuzz-0:1.7.5-2.el7.x86_64",
            "CloudLinux-7:harfbuzz-devel-0:1.7.5-2.el7.i686",
            "CloudLinux-7:harfbuzz-devel-0:1.7.5-2.el7.tuxcare.els1.i686",
            "CloudLinux-7:harfbuzz-devel-0:1.7.5-2.el7.tuxcare.els1.x86_64",
            "CloudLinux-7:harfbuzz-devel-0:1.7.5-2.el7.x86_64",
            "CloudLinux-7:harfbuzz-icu-0:1.7.5-2.el7.i686",
            "CloudLinux-7:harfbuzz-icu-0:1.7.5-2.el7.tuxcare.els1.i686",
            "CloudLinux-7:harfbuzz-icu-0:1.7.5-2.el7.tuxcare.els1.x86_64",
            "CloudLinux-7:harfbuzz-icu-0:1.7.5-2.el7.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ]
    }
  ]
}