CVE-2023-25193: Fedoraproject Fedora

High severity, CVSS 7.5. EPSS: 1.8% chance of exploitation in the next 30 days.

hb-ot-layout-gsubgpos.hh in HarfBuzz through 6.0.0 allows attackers to trigger O(n^2) growth via consecutive marks during the process of looking back for base glyphs when attaching marks.

Affected products

• Fedoraproject Fedora: version 36 only
• Harfbuzz Project Harfbuzz: up to and including 6.0.0

Published 2023-02-04. Last modified 2026-06-17.