Low severity · published Oct 13, 2026
CVE-2026-109854
M17n-lib: uninitialized stack read in iso-2022 compound text utf-8 decoding
2.5
CVSS
0.1%
EPSS
No
On KEV
Description
A flaw was found in m17n-lib. An attacker who supplies crafted input to an application processing ISO-2022 encoded text can cause the library to read uninitialized memory from the stack. If the application exposes or returns the decoded output, this flaw can result in unexpected behavior and limited information disclosure.
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
Attack vector
Local
Complexity
High
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 2% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RH
Red Hat Enterprise Linux 10 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Enterprise Linux 6 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Enterprise Linux 7 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Enterprise Linux 8 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Enterprise Linux 9 · Red Hat
All versions, or not specified · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-109854
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-109854
vdb-entry
https://access.redhat.com/security/cve/CVE-2026-109854
issue-tracking
https://bugzilla.redhat.com/show_bug.cgi?id=2550285
cgit.git.savannah.nongnu.org
https://cgit.git.savannah.nongnu.org/cgit/m17n/m17n-lib.git/commit/?id=f3b85087f90189f91c04ba1b62c5f0b879ff2b20
lists.gnu.org
https://lists.gnu.org/archive/html/m17n-list/2026-10/msg00001.html
More from Red Hat Enterprise Linux 10
7.8
CVE-2026-46300
net: skbuff: preserve shared-frag marker during coalescing
7.8
CVE-2026-31431
crypto: algif_aead - Revert to operating out-of-place
7.5
CVE-2026-34486
Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor
10.0
CVE-2026-46595
Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh
10.0
CVE-2026-34078
Flatpak has a complete sandbox escape leading to host file access and code execution in the host context