debian/m17n-lib vulnerabilities

Latest debian/m17n-lib CVEs

Newest publication first

1. CVE-2026-109854 M17n-lib: uninitialized stack read in iso-2022 compound text utf-8 decoding

   Published 2026-10-13

   Low·CVSS 2.5 EPSS 0.12%

   A flaw was found in m17n-lib. An attacker who supplies crafted input to an application processing ISO-2022 encoded text can cause the library to read uninitialized memory from the stack. If the application exposes or returns the decoded output, this flaw can result in unexpected...

2. CVE-2026-107169 M17n-lib: null-pointer write in read_mtext_element() on malformed utf-8

   Published 2026-10-07

   Medium·CVSS 6.2 EPSS 0.11%

   A flaw was found in m17n-lib. An attacker could provide specially crafted or truncated UTF-8 input to trigger an unhandled null pointer dereference during text processing. This issue causes the application to crash unexpectedly, resulting in a Denial of Service (DoS).

3. CVE-2026-107167 M17n-lib: heap use-after-free write in re_init_ic()

   Published 2026-10-07

   Medium·CVSS 6.2 EPSS 0.12%

   A flaw was found in m17n-lib. A user providing specially crafted text input can trigger a heap use-after-free condition during input-method state transitions. Under specific conditions, the library frees an internal input context object but subsequently attempts to write to that...

4. CVE-2026-107170 M17n-lib: null dereference in minput_open_im() after failed m17n_init()

   Published 2026-10-07

   Low·CVSS 2.9 EPSS 0.10%

   A flaw was found in m17n-lib. A partial failure during library initialization can leave an internal driver pointer uninitialized. Under specific error conditions, such as system resource exhaustion or database corruption, an application attempting to open an input method derefere...

5. CVE-2026-107168 M17n-lib: parser infinite loop on malformed utf-8 in count_utf_8_chars()

   Published 2026-10-07

   Medium·CVSS 6.2 EPSS 0.11%

   A flaw was found in m17n-lib. By providing crafted input containing an invalid UTF-8 character sequence, an attacker can cause the text parsing function to enter an infinite loop. This issue leads to sustained high CPU utilization, resulting in a Denial of Service (DoS) for the a...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.