REDHAT-BUG-2547411: Low severity GNU m17n-lib vulnerability

Published Oct 7, 2026
·
Updated

A flaw was found in m17n-lib. A partial failure during m17ninit() can leave the internal minputdriver pointer NULL. A subsequent call to minputopenim() can dereference this NULL pointer instead of returning an initialization error, resulting in a crash. No reproducer was supplied for this claim, and attempts to force the specific precondition (an early module-init failure inside m17ninit(), e.g. via a bogus M17NDIR) did not trigger it directly -- the library tolerates a missing or invalid database path gracefully in the tested configuration. Source review of src/m17n.c confirms the claimed code path is real: m17ninit() calls a chain of module initializers (mcharsetinit, mcodinginit, mcharsetloadfromdatabase, mcodingloadfromdatabase, mlanginit, mlocaleinit) and jumps to an err: label on the first failure, which skips the subsequent minputinit() call entirely. minputinit() is the only place the global minputdriver pointer is assigned; it is NULL otherwise. src/input.c:4786 then does driver = minputdriver; and src/input.c:4799 dereferences it unconditionally via im->driver = driver; with no NULL check. The crash is real but requires one of the six earlier module initializers to fail first (e.g. under memory pressure or a corrupted system m17n database), a narrower precondition than the other three issues reported alongside this one. No live reproduction was achieved; this assessment is based on code review alone.

Affected Software

1 affected component
GNU m17n-lib

Event History

Oct 7, 2026
Data Sourced
via Red Hat·12:02 PM
DescriptionSeverityAffected Software

Frequently Asked Questions

1

What conditions are required for the crash to occur?

One of the early module initializers called by m17n_init() must fail, causing initialization to exit before minput__init() assigns the internal minput_driver pointer. The application must then call minput_open_im(), which dereferences that still-NULL pointer.

2

Are deployments using an invalid or missing M17NDIR necessarily exposed?

Not based on the available testing. Attempts to trigger the condition with a bogus M17NDIR did not reproduce the crash because the tested library configuration tolerated a missing or invalid database path gracefully.

3

What can be done if an update is not immediately available?

Ensure callers do not proceed to minput_open_im() after m17n_init() reports a failure. Investigate and correct failures in the initialization chain so that m17n_init() completes before input methods are opened.

4

How can an application be identified as potentially affected?

An application is potentially affected if it can continue execution after a partial m17n_init() failure and later invokes minput_open_im(). The expected result is a crash from an unconditional dereference of the uninitialized input-driver pointer.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203