CVE-2026-109854

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-109854
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-109854.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-109854
Downstream
Published
2026-10-13T09:16:55Z
Modified
2026-10-24T02:50:19Z
Severity
  • 2.5 (Low) CVSS_V3 - CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N CVSS Calculator
Summary
M17n-lib: uninitialized stack read in iso-2022 compound text utf-8 decoding
Details

A flaw was found in m17n-lib. An attacker who supplies crafted input to an application processing ISO-2022 encoded text can cause the library to read uninitialized memory from the stack. If the application exposes or returns the decoded output, this flaw can result in unexpected behavior and limited information disclosure.

Database specific 
{
    "cna_assigner":  "redhat",
    "cwe_ids":  [
        "CWE-457"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/109xxx/CVE-2026-109854.json"
}
References

Affected packages

Git / cgit.git.savannah.nongnu.org/cgit/m17n/m17n-lib.git

Affected ranges

Type
GIT
Repo
https://cgit.git.savannah.nongnu.org/cgit/m17n/m17n-lib.git
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
f3b85087f90189f91c04ba1b62c5f0b879ff2b20
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "fixed":  "f3b85087f90189f91c04ba1b62c5f0b879ff2b20"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-109854.json"