EUVD-2026-94313
GHSA-rgch-6vg6-rm4p
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSupply crafted invalid UTF-8 input
-
ExploitTrigger infinite loop in m17n-lib text parser
-
ImpactSustained CPU exhaustion denies service
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Loop termination conditions
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that an application actually passes attacker-influenced text through m17n-lib's parsing path and that the input can contain an invalid UTF-8 byte sequence; the flaw is reached via that text-parsing function rather than any network service. Limiting factors: the CVSS vector is AV:L (local), so the attacker must have a local channel to deliver input to the vulnerable application, there is no code execution or data impact (C:N/I:N), and exposure depends entirely on whether a deployed application uses m17n-lib for text/input-method processing - systems that do not load m17n-lib are unaffected. |
| Impact | This is a moderate-severity, local-only denial-of-service issue (CVSS 6.2, CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) in m17n-lib, where crafted invalid UTF-8 input drives the text parser into an infinite loop (CWE-835) and pins CPU. The signals are internally consistent and point to low urgency: the vector is local (AV:L), so an attacker must already be able to feed input to an application that uses m17n-lib - there is no remote network reach despite PR:N - and impact is confined to availability (C:N/I:N) with no code execution or data exposure. No EPSS score, CISA KEV listing, POC, or SSVC decision data was provided in the input, so exploitation probability and automatability cannot be quantified; the absence of these is expected for a freshly disclosed Red Hat-reported DoS and should not be read as either high or low exploitation likelihood. On balance this is a real but non-urgent bug fix rather than an emergency: a high-CVSS-availability flaw whose local attack vector and DoS-only impact keep real-world risk modest. Note the scope is reported against RHEL versions in the CPE/tags while the actual defective component is m17n-lib - patch the library, not just a specific RHEL release. |
| Exploit ScenarioDerived | A local or otherwise-constrained attacker supplies a text string containing a malformed UTF-8 sequence to an application that relies on m17n-lib for input-method or text parsing (for example via an input field, document, or locale-processed data). The parser enters an infinite loop and consumes CPU indefinitely, degrading or hanging the affected application or service. No public exploit was identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 07, 2026
Sustained CPU consumption in m17n-lib allows an unauthenticated local attacker to hang applications that parse attacker-influenced text, because a crafted invalid UTF-8 byte sequence drives the library's text-parsing routine into a non-terminating loop (CWE-835) and pins a CPU core indefinitely, producing a denial of service (CVSS 6.2, AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Only systems where an application actually routes externally supplied text through m17n-lib's parsing path are exposed; hosts that never load the library are unaffected, and there is no code execution, data leakage, or integrity impact. There is no public exploit identified at time of analysis, and no vendor-released patch identified at time of analysis; Red Hat is tracking the issue under CVE-2026-107168 with Bugzilla 2547409.
RemediationAI
No vendor-released patch was identified at time of analysis, so remediation currently depends on compensating controls and on tracking Red Hat's advisory at https://access.redhat.com/security/cve/CVE-2026-107168 and Bugzilla 2547409 for the eventual errata and fixed package version. Until then, the most effective control is to prevent untrusted bytes from reaching m17n-lib's parser: validate or transcode incoming text to well-formed UTF-8 with a strict validator (for example iconv or an explicit UTF-8 validity check) before handing it to any m17n-based routine, understanding that this only helps if the validation happens upstream of the vulnerable path and adds CPU overhead and possible rejection of legitimately malformed input. Where the parser itself is the entry point, restrict which local users or processes can submit text to applications linked against m17n-lib, since the attack requires a local delivery channel (AV:L). To contain the impact of a hang, run m17n-linked applications under systemd CPUQuota/CPUWeight or cgroup v2 limits, or under ulimit and watchdog supervision that kills runaway processes, accepting the trade-off that legitimate CPU-intensive text processing may be throttled. Monitor for processes linked to libm17n that pin a single core at 100% with no progress, and treat that pattern as an exploitation indicator rather than a routine performance issue; there is no public exploit code identified at this time, so broad emergency mitigations beyond containment are not proportionate to the moderate, local-only severity.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
m17n-lib is a multilingual text-processing library that provides character-set conversion, text rendering, and input-method infrastructure used by desktop input-method engines and other multilingual applications. The flaw sits in the library's text/character parsing path, which handles UTF-8 decoding of incoming strings; when it encounters a malformed or truncated multi-byte UTF-8 sequence, the parsing routine fails to make forward progress - the read position is not advanced and the terminating condition is never reached - so control loops forever. This is the classic CWE-835 'Loop with Unreachable Exit Condition (Infinite Loop)' pattern, and the practical effect is a busy-wait that saturates a CPU core rather than a crash. Red Hat's CPE data covers m17n-lib as a shipped system library across Red Hat Enterprise Linux 6, 7, 8, 9, and 10, meaning the vulnerable code is present in the distribution packages rather than in a single standalone product. Because the CVSS vector is AV:L with C:N/I:N, the parser defect is reachable only through a local channel that feeds text into a linked application; there is no network-reachable service component described in the available data, and the attacker's payload is merely a byte string, requiring no authentication and no user interaction.
Know when Red Hat Enterprise Linux 10 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Local input delivery to the parser gives AV:L; no auth or interaction needed (PR:N/UI:N); only availability affected via CPU-exhausting infinite loop, so C:N/I:N/A:H.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
DescriptionCVE.org
A flaw was found in m17n-lib. By providing crafted input containing an invalid UTF-8 character sequence, an attacker can cause the text parsing function to enter an infinite loop. This issue leads to sustained high CPU utilization, resulting in a Denial of Service (DoS) for the affected application.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Affected Products (CPE)CVE.org
More in Red Hat Enterprise Linux 10
View allHeap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash
Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
Ghostscript can execute arbitrary shell commands with the privileges of its process when it renders a crafted PostScript
Use-after-free in librsvg during rendering of crafted SVG documents with nested XInclude directives and duplicate entity
A signed integer overflow vulnerability exists in the libtiff library's putcontig8bitYCbCr44tile function that leads to
The system CA trust store shipped in Red Hat's ca-certificates RPM packages includes eMudhra root authorities that signe
Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo
Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter
Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a
A heap buffer overflow exists in libsoup's WebSocket permessage-deflate compression path: when a very large outbound mes
Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe
Exploit-DB