CVE-2026-109854
LowCVSS 2.5Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
A flaw was found in m17n-lib. An attacker who supplies crafted input to an application processing ISO-2022 encoded text can cause the library to read uninitialized memory from the stack. This can result in unexpected behavior and limited information disclosure.
Risk Assessment
The risk includes potential data leakage or malfunction of applications using the library, which could be exploited for further attacks.
Recommendation
Update the m17n-lib library to a patched version and avoid processing untrusted input in applications using this library.
Other vulnerabilities in m17n-lib
See all- CVE-2026-107167Medium
A flaw was found in m17n-lib where a user providing specially crafted text input can trigger a heap use-after-free condition during input-method state transitions. Under specific conditions, the library frees an internal input context object but subsequently attempts to write to that freed memory. This can cause applications relying on the library to crash, leading to a Denial of Service (DoS), or potentially allow arbitrary code execution.
- CVE-2026-107168Medium
A flaw was found in m17n-lib. By providing crafted input containing an invalid UTF-8 character sequence, an attacker can cause the text parsing function to enter an infinite loop. This issue leads to sustained high CPU utilization, resulting in a Denial of Service (DoS) for the affected application.
- CVE-2026-107169Medium
A flaw was found in m17n-lib where an attacker could provide specially crafted or truncated UTF-8 input to trigger an unhandled null pointer dereference during text processing. This causes the application to crash unexpectedly, resulting in a Denial of Service (DoS).
- CVE-2026-107170Low
A flaw was found in m17n-lib where a partial failure during library initialization can leave an internal driver pointer uninitialized. Under specific error conditions, such as system resource exhaustion or database corruption, an application attempting to open an input method dereferences this null pointer without proper validation, causing a crash (DoS).
Original NVD description (English source)
A flaw was found in m17n-lib. An attacker who supplies crafted input to an application processing ISO-2022 encoded text can cause the library to read uninitialized memory from the stack. If the application exposes or returns the decoded output, this flaw can result in unexpected behavior and limited information disclosure.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS