m17n-lib EUVD-2026-98377

Exploitation requires that an application built on m17n-lib decode attacker-supplied ISO-2022 encoded text AND that the application subsequently expose or return the decoded output back to the attacker - both conditions must hold for any information to leak. Limiting factors: the CVSS vector is AV:L (local input processing) with AC:H and UI:R, so a user must actively process the malicious input and the uninitialized-memory read is not reliably controllable; impact is confined to limited confidentiality (C:L) with no integrity or availability effect. Realistic risk is therefore gated by whether a deployed application both uses m17n-lib's ISO-2022 decoder and reflects its output, which is not the case for most installations.

All signals point to a genuinely low-priority issue rather than a high-CVSS-but-overblown case - here the CVSS itself is low (2.5) and the real-world risk is correspondingly minor. The CVSS 3.1 vector (AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N) describes a local attack path with high complexity, requiring user interaction, yielding only limited confidentiality impact and no integrity or availability impact - consistent with an uninitialized-stack read (CWE-457) that leaks small, non-attacker-controlled fragments of memory. No EPSS score was supplied in the input, so exploitation probability cannot be quantified. This is not in CISA KEV and no public exploit was provided, so there is no public exploit identified at time of analysis. A vendor fix commit exists upstream (savannah m17n-lib.git), which confirms the flaw is real and patched but is not itself a weaponized exploit. One caveat worth verifying: Red Hat scored this AV:L, but applications that feed network-sourced ISO-2022 text (e.g., mail or document viewers) into m17n-lib could arguably make the input reachable remotely - the practical reachability therefore depends on how the consuming application obtains the crafted text. Net assessment: low priority, patch during normal maintenance cycles.

An attacker crafts malformed ISO-2022 encoded text and gets a victim to open or process it in an application that uses m17n-lib for decoding (for example an input-method-enabled editor or a text/document viewer). The library reads uninitialized stack memory while decoding, and if the application echoes or returns the decoded output, small fragments of process memory may be disclosed to the attacker. No public exploit code was provided, and the high attack complexity plus required user interaction make reliable, targeted leakage difficult.