DEBIAN-CVE-2026-107167

See a problem?
Please try reporting it to the source first.
Source
https://security-tracker.debian.org/tracker/CVE-2026-107167
Import Source
https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-107167.json
JSON Data
https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-107167
Upstream
  • CVE-2026-107167
Published
2026-10-07T15:17:18Z
Modified
2026-10-08T05:00:07Z
Severity
  • 6.2 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
[none]
Details

A flaw was found in m17n-lib. A user providing specially crafted text input can trigger a heap use-after-free condition during input-method state transitions. Under specific conditions, the library frees an internal input context object but subsequently attempts to write to that freed memory. This issue can cause applications relying on the library to crash, leading to a Denial of Service (DoS), or potentially allow arbitrary code execution.

References

Affected packages

Debian:12 / m17n-lib

Package

Name
m17n-lib
Purl
pkg:deb/debian/m17n-lib?arch=source&distro=bookworm

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

1.*
1.8.0-6
1.8.2-1
1.8.3-1
1.8.3-2
1.8.4-1
1.8.4-2
1.8.5-1
1.8.6-1

Ecosystem specific 

{
    "urgency":  "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-107167.json"

Debian:13 / m17n-lib

Package

Name
m17n-lib
Purl
pkg:deb/debian/m17n-lib?arch=source&distro=trixie

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

1.*
1.8.5-1
1.8.6-1

Ecosystem specific 

{
    "urgency":  "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-107167.json"

Debian:14 / m17n-lib

Package

Name
m17n-lib
Purl
pkg:deb/debian/m17n-lib?arch=source&distro=forky

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

1.*
1.8.5-1
1.8.6-1

Ecosystem specific 

{
    "urgency":  "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-107167.json"