CVE-2021-45931: Fedoraproject Fedora

Medium severity, CVSS 6.5. EPSS: 1.8% chance of exploitation in the next 30 days.

HarfBuzz 2.9.0 has an out-of-bounds write in hb_bit_set_invertible_t::set (called from hb_sparseset_t<hb_bit_set_invertible_t>::set and hb_set_copy).

Affected products

• Fedoraproject Fedora: version 34 only; version 35 only
• Harfbuzz Project Harfbuzz: version 2.9.0 only

Published 2022-01-01. Last modified 2026-06-17.