CVE-2026-22693 is a null pointer dereference vulnerability in the HarfBuzz library's SubtableUnicodesCache::create function. The function does not check if hb_malloc returns NULL before using placement new to construct an object, leading to undefined behavior and a segmentation fault when memory allocation fails. This vulnerability can cause a denial of service in affected Red Hat products that include and link against HarfBuzz, including certain OpenJDK builds with the java.desktop module and components like Firefox and Thunderbird. Headless OpenJDK packages without the java.desktop module are not affected. Red Hat has not provided an official fix or mitigation that meets their criteria for ease of use, applicability, or stability.

The vulnerability may cause affected applications to crash due to a segmentation fault when memory allocation fails, resulting in a denial of service. There is no impact on confidentiality or integrity reported. The issue affects availability by potentially causing process termination. No known exploits are reported in the wild.

Red Hat currently does not provide a mitigation or fix that meets their criteria for deployment and stability. Users should monitor Red Hat advisories for future updates. Headless OpenJDK environments without the java.desktop module are not affected. No immediate action is required beyond applying updates when available.