CVE-2026-107167
Awaiting Analysis Awaiting Analysis - Queue

Heap Use-After-Free in m17n-lib Input Context

Publication date: 2026-10-07

Last updated on: 2026-10-07

Assigner: redhat-SADP

Description
A flaw was found in m17n-lib. A user providing specially crafted text input can trigger a heap use-after-free condition during input-method state transitions. Under specific conditions, the library frees an internal input context object but subsequently attempts to write to that freed memory. This issue can cause applications relying on the library to crash, leading to a Denial of Service (DoS), or potentially allow arbitrary code execution.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-07
Last Modified
2026-10-07
Generated
2026-10-07
AI Q&A
2026-10-07
EPSS Evaluated
N/A
NVD
CVE-2026-107167
EUVD
EUVD-2026-94365

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-416 The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a heap use-after-free vulnerability in m17n-lib. When a user provides specially crafted text input, the library may free an internal input context object but later attempt to write to that freed memory during input-method state transitions. This can lead to memory corruption, crashes, or potentially arbitrary code execution.

Detection Guidance

Detecting this vulnerability requires monitoring for crashes or memory corruption in applications using m17n-lib. Check logs for segmentation faults or heap corruption errors in processes linked to the library. Use tools like Valgrind to detect use-after-free conditions during input handling.

Impact Analysis

The vulnerability can crash applications relying on m17n-lib, causing a Denial of Service (DoS). In some cases, it may allow arbitrary code execution, potentially leading to further system compromise. The impact depends on how the library is used in applications.

Compliance Impact

This vulnerability does not directly impact compliance with GDPR or HIPAA as it primarily causes application crashes or potential arbitrary code execution. Compliance risks would arise only if the vulnerability leads to unauthorized data access or processing disruptions in systems handling protected data.

Mitigation Strategies

Since no effective mitigation is currently available, monitor for updates from Red Hat or the m17n-lib project. Avoid using untrusted text input in applications relying on m17n-lib until a patch is released. Consider temporarily disabling affected input methods if feasible.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-107167. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart