CVE-2026-109854: M17n-lib: uninitialized stack read in iso-2022 compound text utf-8 decoding

Severity: low (CVSS 2.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-13 · updated 2026-10-16
Weakness: CWE-457

Description

A flaw was found in m17n-lib. An attacker who supplies crafted input to an application processing ISO-2022 encoded text can cause the library to read uninitialized memory from the stack. If the application exposes or returns the decoded output, this flaw can result in unexpected behavior and limited information disclosure.

Affected products

Red Hat Enterprise Linux 10: all versions
Red Hat Enterprise Linux 7: all versions
Red Hat Enterprise Linux 8: all versions
Red Hat Enterprise Linux 9: all versions

References

https://access.redhat.com/security/cve/CVE-2026-109854
https://bugzilla.redhat.com/show_bug.cgi?id=2550285
https://cgit.git.savannah.nongnu.org/cgit/m17n/m17n-lib.git/commit/?id=f3b85087f90189f91c04ba1b62c5f0b879ff2b20
https://lists.gnu.org/archive/html/m17n-list/2026-10/msg00001.html

Get alerted when CVE-2026-109854 or the next vulnerability affects your stack