CVE-2026-109854

Published: Oct 13, 2026Modified: Oct 16, 2026

2.5

Vector

CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

Exploitability: 1.0 / Impact: 1.4

Source: secalert@redhat.com (Secondary)

Description

A flaw was found in m17n-lib. An attacker who supplies crafted input to an application processing ISO-2022 encoded text can cause the library to read uninitialized memory from the stack. If the application exposes or returns the decoded output, this flaw can result in unexpected behavior and limited information disclosure.

Related CWEs

CWE-457

Use of Uninitialized Variable

The code uses a variable that has not been initialized, leading to unpredictable or unintended results.

References (4)

https://access.redhat.com/security/cve/CVE-2026-109854

Source: secalert@redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=2550285

Source: secalert@redhat.com

https://cgit.git.savannah.nongnu.org/cgit/m17n/m17n-lib.git/commit/?id=f3b85087f90189f91c04ba1b62c5f0b879ff2b20

Source: secalert@redhat.com

https://lists.gnu.org/archive/html/m17n-list/2026-10/msg00001.html

Source: secalert@redhat.com

Timeline

No history available yet.