A flaw was found in m17n-lib. The decode_coding_iso_2022() function in src/coding.c reads uninitialized stack memory when decoding crafted input using the ISO-2022 Compound Text extension. An ESC % G escape sequence activates UTF-8 shifting, after which an invalid UTF-8 lead byte of 0xFE or 0xFF causes CHAR_BYTES_BY_HEAD() to return zero. The decoder skips the continuation-byte initialization loop, leaving buf[1] through buf[5] of its local int buf[6] array uninitialized, but still passes the buffer to UTF8_CHARSET() and STRING_CHAR_UTF8(). The resulting character value can incorporate data from uninitialized stack contents and be stored in the decoded text. An attacker able to supply input to an application using this decoding path may cause nondeterministic output and potentially limited information disclosure if the application exposes the decoded values. Reliable disclosure of sensitive process memory has not been demonstrated.