m17n-lib EUVD-2026-94366

Exploitation requires an application that links and uses m17n-lib for text/UTF-8 processing (e.g., m17n-based input methods or text handling on Red Hat Enterprise Linux 6 through 10), and the attacker must be able to supply crafted or truncated UTF-8 input into that local processing path. No authentication or privileges are needed to provide the input (PR:N), and no user interaction is required (UI:N). Exploitation is LIMITED by the local attack vector (AV:L) - the malicious input must reach a locally running m17n-lib consumer rather than being delivered over the network - and impact is confined to a crash (availability only); systems that do not route untrusted text through m17n-lib are not exposed.

This is a moderate-severity local Denial-of-Service issue, not a high-priority remote threat. The provided CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, score 6.2) is internally consistent with the description: an attacker supplies crafted or truncated UTF-8 input that is parsed locally by an application linked against m17n-lib, triggering a NULL pointer dereference (CWE-476) and crash. Impact is availability-only - no confidentiality or integrity loss - which caps real-world severity. No EPSS score, SSVC decision, KEV listing, or POC indicator was supplied in the input; accordingly, exploitation status is 'no public exploit identified at time of analysis.' The local attack vector (AV:L) is the key limiter: the attacker must already be able to feed input into a process using m17n-lib, so there is no network-facing mass-exploitation path. Note the PR:N / AV:L combination - no privileges are needed to supply the malicious input, but the input must reach a locally running consumer of the library, meaning risk is realistically scoped to multi-user systems or applications that process untrusted text through m17n-lib. Overall this is a 'real but low-urgency' bug: genuine crash primitive, but limited blast radius and no code execution.

On a shared Linux host, a low-privileged user crafts a truncated/malformed UTF-8 string and passes it to an application (e.g., an input method or text renderer) that processes it via m17n-lib. The unhandled NULL pointer dereference crashes the consuming application, denying service to that process. No public exploit code is identified in the provided data, and the local attack vector means impact is confined to the affected host.