dash EUVD-2026-88668

Requires local access to a host where dash is invoked. The attacker supplies a crafted Unicode \u or \U escape that decodes to a 5-6 byte UTF-8 token to the dash printf builtin or to echo %b - reachable non-interactively via 'dash -c' with the escape passed as a positional argument. Exploitation is limited to local users, produces only a bounded 1-2 byte out-of-bounds write with no demonstrated code-execution primitive, and the corruption stays within the caller's own dash process, so it confers no inherent privilege escalation.

This is a low-severity local memory-safety flaw, not a priority. The provided CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) computes to roughly 3.3, and the listed 'CVSS Score: 4.0' appears to be a Red Hat CVSS 4.0 base score rather than a 3.1 score - both agree the real-world risk is minor. Attack vector is LOCAL (the attacker must already be able to run dash on the host), there is no confidentiality or availability impact, and the integrity impact is limited to a controlled 1-2 byte out-of-bounds write past a fixed reservation. There is no EPSS score, no CISA KEV listing, and no public exploit code referenced, so exploitation is theoretical. A 1-2 byte overflow is a genuine CWE-787 bug but the description shows no path to code execution or privilege escalation, and dash's printf typically runs at the caller's own privilege - so a local user overflowing memory in their own shell process gains little. Note the CPE lists only Red Hat Enterprise Linux 6, which is unusual since dash is a Debian-family shell and not RHEL 6's default /bin/sh; the affected component is dash itself, so scope should be read as the dash package wherever deployed, not RHEL 6 specifically.

A local user on a system running dash executes 'dash -c' (or a printf/echo %b command) supplying a crafted multi-byte Unicode \u or \U escape that decodes to a 5-6 byte UTF-8 sequence, exceeding dash's 4-byte reservation and writing 1-2 bytes past it. No public exploit code is referenced, and the corruption is confined to the attacker's own dash process, offering no demonstrated privilege gain.