CVE-2026-109854

EUVD-2026-98377
A flaw was found in m17n-lib. An attacker who supplies crafted input to an application processing ISO-2022 encoded text can cause the library to read uninitialized memory from the stack. If the application exposes or returns the decoded output, this flaw can result in unexpected behavior and limited information disclosure.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
2.5 LOW
LOCAL
HIGH
NONE
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 3.77%
Debian logo
Debian Releases
Debian Product
Codename
m17n-lib
bookworm
vulnerable
forky
vulnerable
sid
vulnerable
trixie
no-dsa
Common Weakness Enumeration
References
https://access.redhat.com/security/cve/CVE-2026-109854
https://bugzilla.redhat.com/show_bug.cgi?id=2550285
https://cgit.git.savannah.nongnu.org/cgit/m17n/m17n-lib.git/commit/?id=f3b85087f90189f91c04ba1b62c5f0b879ff2b20
https://lists.gnu.org/archive/html/m17n-list/2026-10/msg00001.html