CVE-2026-109854
Received Received - Intake

Heap Buffer Overflow in m17n-lib

Publication date: 2026-10-13

Last updated on: 2026-10-13

Assigner: redhat-SADP

Description
A flaw was found in m17n-lib. An attacker who supplies crafted input to an application processing ISO-2022 encoded text can cause the library to read uninitialized memory from the stack. If the application exposes or returns the decoded output, this flaw can result in unexpected behavior and limited information disclosure.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-13
Last Modified
2026-10-13
Generated
2026-10-13
AI Q&A
2026-10-13
EPSS Evaluated
N/A
NVD
CVE-2026-109854
EUVD
EUVD-2026-98377

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
Red Hat Red Hat Enterprise Linux 10 *
Red Hat Red Hat Enterprise Linux 7 *
Red Hat Red Hat Enterprise Linux 8 *
Red Hat Red Hat Enterprise Linux 9 *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-457 The code uses a variable that has not been initialized, leading to unpredictable or unintended results.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in the m17n-lib library. It involves crafted input to applications processing ISO-2022 encoded text causing the library to read uninitialized memory from the stack. If the application returns or exposes decoded output, it may lead to unexpected behavior and limited information disclosure.

Detection Guidance

Detecting this vulnerability requires checking for vulnerable versions of m17n-lib. Inspect installed packages using commands like 'rpm -qa | grep m17n-lib' on Red Hat systems or 'dpkg -l | grep m17n-lib' on Debian-based systems. Review application logs for crashes or unexpected behavior when processing ISO-2022 encoded text.

Impact Analysis

An attacker could exploit this to cause nondeterministic output or limited information disclosure if the application reveals decoded values. However, reliable disclosure of sensitive process memory has not been demonstrated. The impact is considered low severity.

Compliance Impact

This vulnerability involves limited information disclosure due to uninitialized memory read, which could potentially expose small amounts of data. For GDPR, this may risk unauthorized data exposure if personal data is involved. For HIPAA, it could lead to incidental disclosure of protected health information. However, the low severity and limited impact reduce compliance risks.

Mitigation Strategies
  • Upgrade m17n-lib to version 1.8.7 or later using package managers like 'yum update m17n-lib' or 'apt-get install --only-upgrade m17n-lib'.
  • Apply patches provided by Red Hat for affected Enterprise Linux versions (7, 8, 9, 10).
  • Audit applications using m17n-lib to ensure they handle ISO-2022 encoded input safely.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109854. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart