Bug 2550285 (CVE-2026-109854)

Summary: CVE-2026-109854 m17n-lib: Uninitialized stack read in ISO-2022 Compound Text UTF-8 decoding
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: rhel-process-autobot, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in m17n-lib. An attacker who supplies crafted input to an application processing ISO-2022 encoded text can cause the library to read uninitialized memory from the stack. If the application exposes or returns the decoded output, this flaw can result in unexpected behavior and limited information disclosure.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-10-13 08:21:32 UTC 
A flaw was found in m17n-lib. The decode_coding_iso_2022() function in src/coding.c reads uninitialized stack memory when decoding crafted input using the ISO-2022 Compound Text extension. An ESC % G escape sequence activates UTF-8 shifting, after which an invalid UTF-8 lead byte of 0xFE or 0xFF causes CHAR_BYTES_BY_HEAD() to return zero. The decoder skips the continuation-byte initialization loop, leaving buf[1] through buf[5] of its local int buf[6] array uninitialized, but still passes the buffer to UTF8_CHARSET() and STRING_CHAR_UTF8(). The resulting character value can incorporate data from uninitialized stack contents and be stored in the decoded text. An attacker able to supply input to an application using this decoding path may cause nondeterministic output and potentially limited information disclosure if the application exposes the decoded values. Reliable disclosure of sensitive process memory has not been demonstrated.