CVE-2026-107168
MediumCVSS 6.2Summary
A flaw was found in m17n-lib. By providing crafted input containing an invalid UTF-8 character sequence, an attacker can cause the text parsing function to enter an infinite loop. This issue leads to sustained high CPU utilization, resulting in a Denial of Service (DoS) for the affected application.
Risk Assessment
An attacker can cause unavailability of applications using m17n-lib, potentially disrupting services.
Recommendation
Update m17n-lib to a patched version or restrict access to applications processing untrusted input.
Other vulnerabilities in m17n-lib
See all- CVE-2026-107169Medium
A flaw was found in m17n-lib where an attacker could provide specially crafted or truncated UTF-8 input to trigger an unhandled null pointer dereference during text processing. This causes the application to crash unexpectedly, resulting in a Denial of Service (DoS).
- CVE-2026-107167Medium
A flaw was found in m17n-lib where a user providing specially crafted text input can trigger a heap use-after-free condition during input-method state transitions. Under specific conditions, the library frees an internal input context object but subsequently attempts to write to that freed memory. This can cause applications relying on the library to crash, leading to a Denial of Service (DoS), or potentially allow arbitrary code execution.
- CVE-2026-107170Low
A flaw was found in m17n-lib where a partial failure during library initialization can leave an internal driver pointer uninitialized. Under specific error conditions, such as system resource exhaustion or database corruption, an application attempting to open an input method dereferences this null pointer without proper validation, causing a crash (DoS).
Original NVD description (English source)
A flaw was found in m17n-lib. By providing crafted input containing an invalid UTF-8 character sequence, an attacker can cause the text parsing function to enter an infinite loop. This issue leads to sustained high CPU utilization, resulting in a Denial of Service (DoS) for the affected application.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS