diff --git a/harfbuzz-8.1.1-ot-tag-guard-against-null-language-in-hb-cce964c.patch b/harfbuzz-8.1.1-ot-tag-guard-against-null-language-in-hb-cce964c.patch
new file mode 100644
index 0000000000000000000000000000000000000000..80f98e86f1e32e4610e53b1c7540472c365ad0d7
--- /dev/null
+++ b/harfbuzz-8.1.1-ot-tag-guard-against-null-language-in-hb-cce964c.patch
@@ -0,0 +1,44 @@
+From cce964cb4f3f29a9addbb079b52c7a712fba93b8 Mon Sep 17 00:00:00 2001
+From: Sai Asish Y <say.apm35@gmail.com>
+Date: Tue, 21 Jul 2026 17:47:36 -0700
+Subject: [PATCH] [ot-tag] guard against NULL language in
+ hb_ot_tags_to_script_and_language (#6085)
+
+hb_ot_tag_to_language returns NULL for HB_OT_TAG_DEFAULT_LANGUAGE, and hb_language_to_string returns NULL for it, so the script-suffix path called strlen on a NULL pointer whenever the primary script tag did not match the input. Skip the suffix construction when there is no base language string and leave the default (NULL) language in place.
+
+Signed-off-by: Sai Asish Y <say.apm35@gmail.com>
+---
+ src/hb-ot-tag.cc       | 4 ++--
+ test/api/test-ot-tag.c | 3 +++
+ 2 files changed, 5 insertions(+), 2 deletions(-)
+diff --git a/src/hb-ot-tag.cc b/src/hb-ot-tag.cc
+index 53b6b38..d92a2f5 100644
+--- a/src/hb-ot-tag.cc
++++ b/src/hb-ot-tag.cc
+@@ -584,10 +584,10 @@ hb_ot_tags_to_script_and_language (hb_tag_t       script_tag,
+ 					 primary_script_tag,
+ 					 nullptr, nullptr);
+     *language = hb_ot_tag_to_language (language_tag);
+-    if (script_count == 0 || primary_script_tag[0] != script_tag)
++    const char *lang_str = *language ? hb_language_to_string (*language) : nullptr;
++    if (lang_str && (script_count == 0 || primary_script_tag[0] != script_tag))
+     {
+       unsigned char *buf;
+-      const char *lang_str = hb_language_to_string (*language);
+       size_t len = strlen (lang_str);
+       buf = (unsigned char *) hb_malloc (len + 16);
+       if (unlikely (!buf))
+diff --git a/test/api/test-ot-tag.c b/test/api/test-ot-tag.c
+index 14928e0..0374dff 100644
+--- a/test/api/test-ot-tag.c
++++ b/test/api/test-ot-tag.c
+@@ -281,6 +281,9 @@ test_ot_tags_to_script_and_language (void)
+   test_tags_to_script_and_language ("dev2", "MAR", "Deva", "mr-x-hbsc-64657632");
+   test_tags_to_script_and_language ("dev3", "MAR", "Deva", "mr");
+   test_tags_to_script_and_language ("qaa", "QTZ0", "Qaaa", "x-hbot-51545a30-hbsc-71616120");
++  /* Default language tag maps to a NULL language; the script-suffix path
++   * must not dereference it. */
++  test_tags_to_script_and_language ("DFLT", "dflt", "", NULL);
+ }
+ 
+ static void
diff --git a/harfbuzz.spec b/harfbuzz.spec
index 2711c0ba983a90e4db528be6e8299b7774b8b95d..1a30af71496e2ff809f5ac5c90be56d3743339b5 100644
--- a/harfbuzz.spec
+++ b/harfbuzz.spec
@@ -1,12 +1,13 @@
 Summary:        HarfBuzz text shaping engine
 Name:           harfbuzz
 Version:        8.1.1
-Release:        8%{?dist}
+Release:        9%{?dist}
 License:        MIT
 URL:            http://harfbuzz.org/
 Source0:        https://github.com/harfbuzz/harfbuzz/releases/download/%{version}/harfbuzz-%{version}.tar.xz
 
 Patch0001:       harfbuzz-8.1.1-CVE-2026-22693.patch
+Patch0002:       harfbuzz-8.1.1-ot-tag-guard-against-null-language-in-hb-cce964c.patch
 
 BuildRequires:  gcc, gcc-c++, make, automake, libtool, gtk-doc
 BuildRequires:  freetype-devel, glib2-devel, cairo-devel, gobject-introspection-devel, libicu-devel, graphite2-devel
@@ -112,6 +113,10 @@ make check
 %{_libdir}/libharfbuzz-icu.so.*
 
 %changelog
+* Wed Jul 22 2026 PkgAgent Robot <pkgagent@opencloudos.tech> - 8.1.1-9
+- [Type] security
+- [DESC] Fix NULL pointer dereference in hb_ot_tags_to_script_and_language when language tag is DFLT/dflt
+
 * Mon Jan 12 2026 ze-you-liu <zeyouliu@tencent.com> - 8.1.1-8
 - [Type] security
 - [DESC] Fix CVE-2026-22693 vulnerability