CVE-2026-102474

MediumCVSS 4.0

Published: 29/09/2026(UTC)Updated: 29/09/2026(UTC)Translated: 29/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.14%

3th percentile - higher than 3% of all known CVEs

Summary

In the dash shell, the printf builtin reserves four bytes before converting a Unicode \u or \U escape, but the multi-byte token can need five or six bytes. A local user who can supply such an escape to dash printf or echo %b can write one or two bytes past that reservation.

Risk Assessment

A local user could trigger an out-of-bounds write, potentially leading to memory corruption or code execution. This affects systems using dash as their shell.

Recommendation

Update the dash package to a version containing the fix for the Unicode escape byte reservation issue.

Other vulnerabilities in dash

CVE-2026-102473Medium
In the dash shell, when built without libc fnmatch, the internal pmatch() matcher implements * by unbounded recursion over candidate positions. A local user who can plant filenames or otherwise feed that matcher can make a short multi-star pattern such as *.*.*.*.*.tar.gz consume excessive CPU.

Original NVD description (English source)

A flaw was found in dash. The printf builtin reserves four bytes before converting a Unicode \u or \U escape, but the multi-byte token can need five or six bytes. A local user who can supply such an escape to dash printf or echo %b, including through dash -c and a positional argument, can write one or two bytes past that reservation.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS