========================================================================
CVE-2026-0943                                        CPAN Security Group
========================================================================

         CVE ID:  CVE-2026-0943
   Distribution:  HarfBuzz-Shaper
       Versions:  before 0.032

       MetaCPAN:  https://metacpan.org/dist/HarfBuzz-Shaper
       VCS Repo:  https://github.com/sciurius/perl-HarfBuzz-Shaper

HarfBuzz::Shaper versions before 0.032 for Perl contains a bundled
library with a null pointer dereference vulnerability

Description
-----------
HarfBuzz::Shaper versions before 0.032 for Perl contains a bundled
library with a null pointer dereference vulnerability.

Versions before 0.032 contain HarfBuzz 8.4.0 or earlier bundled as
hb_src.tar.gz in the source tarball, which is affected by
CVE-2026-22693.

Problem types
-------------
- CWE-1395 Dependency on Vulnerable Third-Party Component

Solutions
---------
Users should update to version 0.032 or later, where the bundled
HarfBuzz library was updated to version 12.3.0.

References
----------
https://bugzilla.redhat.com/show_bug.cgi?id=2429296
https://www.cve.org/CVERecord?id=CVE-2026-22693
https://metacpan.org/release/JV/HarfBuzz-Shaper-0.032/changes