libhangul CVE-2026-108063

Requires an application using libhangul to load and query an attacker-supplied, specially crafted Hanja dictionary file in which an entry contains a key but no valid associated value, triggering the NULL pointer dereference during parsing. Exploitation is limited by three factors reflected in the CVSS vector: the attacker needs local delivery of the malicious dictionary file (AV:L), the victim must actively load/query that dictionary (UI:R), and impact is confined to crashing the consuming application (A:H only, no confidentiality or integrity effect). It is not remotely or unauthenticated-network exploitable, and cannot yield code execution.

This is a moderate, availability-only issue that should be treated as low operational priority. The provided CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, base 5.5) is internally consistent: local attack vector plus required user interaction (the victim must supply/query a crafted Hanja dictionary file), with impact limited to a crash (A:H, C/I:N). There is no EPSS score, no CISA KEV listing, and no POC in the provided data, so exploitation status is 'no public exploit identified at time of analysis.' SSVC-style reasoning reinforces low urgency: exploitation is not automatable (requires a user to load a malicious dictionary), technical impact is partial (DoS only, no code execution or data exposure despite the local vector), and there is no evidence of active exploitation. The signals do not conflict - a CWE-476 NULL pointer dereference causing a crash aligns fully with the A:H/C:N/I:N profile. Net: a legitimately-scored medium-severity bug whose real-world risk is low because it is local, needs user interaction, and only crashes the consuming application.

An attacker crafts a malformed Hanja dictionary file containing an entry whose key has no valid associated value, then delivers it to a victim (e.g., as a user-supplied or shared dictionary). When the victim's application loads and queries that dictionary via libhangul, the library dereferences a NULL pointer and the application crashes. No public exploit code is identified in the provided data, and the local vector plus required user interaction keep the attack low-complexity but non-remote.