m17n-lib CVE-2026-107167

Exploitation requires local delivery of crafted text through an application that uses m17n-lib for input-method processing (e.g. IBus/m17n engines for CJK, Indic, or other complex-script input), and the specific input-method state transition that frees the input context must be reached - the description notes the write-after-free occurs only 'under specific conditions,' indicating it is not triggered by all input. Limiting factors: the vector is Local (AV:L), so no remote network reach; the affected code path is only active when m17n-based input methods are in use rather than on every Linux system by default; and the confirmed impact is a crash (A:H) with no confidentiality or integrity effect, so even successful triggering yields denial of service rather than verified code execution.

This is a moderate-severity, locally-exploitable memory-corruption flaw (CWE-416 use-after-free) in m17n-lib, rated CVSS 6.2 with vector CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. The signals are internally consistent and point to a DoS-primarily issue: the vendor-assigned impact is Availability-only (A:H) with no confidentiality or integrity impact, and the attack vector is Local (AV:L), meaning an attacker must supply crafted text through the input-method pipeline rather than reaching it remotely over a network. There is no CISA KEV listing and no public proof-of-concept referenced, so exploitation status is 'no public exploit identified at time of analysis.' No EPSS score was provided in the input, so exploitation probability cannot be quantified. The description's mention of 'potentially allow arbitrary code execution' is speculative and NOT reflected in the CVSS impact metrics (C:N/I:N), so code execution should be treated as unconfirmed and theoretical - the practical, confirmed outcome is an application crash. Net assessment: this is a legitimate but lower-priority defect - a local DoS in a desktop input library, not a network-exploitable critical. It warrants patching in normal cycles rather than emergency response. Note the conflict between the 'RCE' tag and the A-only CVSS impact; the RCE framing is not substantiated by the vector.

A local user (or a process feeding text into an application that uses m17n-lib, such as an IBus-based input method) submits specially crafted input that forces an input-method state transition freeing the internal input context object, after which the library writes to that freed memory. The result is a crash of the consuming application (denial of service); arbitrary code execution is theorized by the vendor but unconfirmed. No public exploit code is known at time of analysis.