Memory Disclosure Vulnerability in m17n-lib Affects Multiple Products
CVE-2026-109854

2.5LOW

Key Information:

Vendor

Red Hat
Status
Red Hat Enterprise Linux 10
Red Hat Enterprise Linux 6
Red Hat Enterprise Linux 7
Red Hat Enterprise Linux 8
Vendor
CVE Published:
13 October 2026

What is CVE-2026-109854?

A vulnerability exists within the m17n-lib library that can be exploited when an attacker provides specially crafted input to applications processing ISO-2022 encoded text. This flaw allows the library to access uninitialized memory from the stack, which can lead to unexpected behaviors and the potential unauthorized disclosure of sensitive information if the decoded output is improperly handled by the application.

References

https://access.redhat.com/security/cve/CVE-2026-109854
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2550285
issue-trackingx_refsource_REDHAT
https://cgit.git.savannah.nongnu.org/cgit/m17n/m17n-lib.g...

CVSS V3.1

Score:
2.5
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Red Hat would like to thank Chamod Anuradha Denipitiya for reporting this issue.
.