CVE-2026-107169: M17n-lib: null-pointer write in read_mtext_element() on malformed utf-8
A flaw was found in m17n-lib. An attacker could provide specially crafted or truncated UTF-8 input to trigger an unhandled null pointer dereference during text processing. This issue causes the application to crash unexpectedly, resulting in a Denial of Service (DoS).
Affected Software
Event History
Frequently Asked Questions
What level of access does an attacker need to trigger this issue?
The vector is local and requires no privileges or user interaction. An attacker must be able to supply specially crafted or truncated UTF-8 input that the affected application processes using m17n-lib.
What is the practical impact of successful exploitation?
Successful exploitation crashes the application during text processing, causing a denial of service. The provided data indicates no confidentiality or integrity impact.
What can be done if a fix is not immediately available?
Restrict or validate untrusted UTF-8 input before it reaches m17n-lib text processing, particularly rejecting malformed or truncated sequences. Limit local users or processes that can provide input to affected applications where possible.