CVE-2026-109854: M17n-lib: uninitialized stack read in iso-2022 compound text utf-8 decoding
A flaw was found in m17n-lib. An attacker who supplies crafted input to an application processing ISO-2022 encoded text can cause the library to read uninitialized memory from the stack. If the application exposes or returns the decoded output, this flaw can result in unexpected behavior and limited information disclosure.
Other sources
A flaw was found in m17n-lib. The decodecodingiso2022() function in src/coding.c reads uninitialized stack memory when decoding crafted input using the ISO-2022 Compound Text extension. An ESC % G escape sequence activates UTF-8 shifting, after which an invalid UTF-8 lead byte of 0xFE or 0xFF causes CHARBYTESBYHEAD() to return zero. The decoder skips the continuation-byte initialization loop, leaving buf[1] through buf[5] of its local int buf[6] array uninitialized, but still passes the buffer to UTF8CHARSET() and STRINGCHARUTF8(). The resulting character value can incorporate data from uninitialized stack contents and be stored in the decoded text. An attacker able to supply input to an application using this decoding path may cause nondeterministic output and potentially limited information disclosure if the application exposes the decoded values. Reliable disclosure of sensitive process memory has not been demonstrated.
— Red Hat