CVE-2026-108063: Libhangul: null pointer dereference in hanja_new() when looking up a malformed hanja dictionary entry
A flaw was found in libhangul. When parsing Hanja dictionary files, the library fails to verify that an entry contains a valid value alongside its key. By providing a specially crafted dictionary file to an application that queries it, an attacker can trigger an unexpected application crash, resulting in a Denial of Service (DoS).
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using libhangul to parse or query Hanja dictionary files are exposed when they can be made to use a malformed dictionary entry. The impact described is an application crash and denial of service.
What does an attacker need to exploit it?
An attacker needs to provide a specially crafted Hanja dictionary file containing an entry with a key but no valid associated value, and have an application query that dictionary. The supplied vector indicates local attack access and user interaction is required.
What is the security impact?
Successful exploitation causes an unexpected application crash through a null pointer dereference. No confidentiality or integrity impact is indicated; the stated impact is denial of service.