CVE-2026-107170
LowCVSS 2.9Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
A flaw was found in m17n-lib where a partial failure during library initialization can leave an internal driver pointer uninitialized. Under specific error conditions, such as system resource exhaustion or database corruption, an application attempting to open an input method dereferences this null pointer without proper validation, causing a crash (DoS).
Risk Assessment
The vulnerability may lead to crashes in applications using m17n-lib, potentially causing service disruption and system unavailability.
Recommendation
Apply the vendor's patch if available, or avoid conditions leading to initialization errors, such as resource exhaustion.
Other vulnerabilities in m17n-lib
See all- CVE-2026-107167Medium
A flaw was found in m17n-lib where a user providing specially crafted text input can trigger a heap use-after-free condition during input-method state transitions. Under specific conditions, the library frees an internal input context object but subsequently attempts to write to that freed memory. This can cause applications relying on the library to crash, leading to a Denial of Service (DoS), or potentially allow arbitrary code execution.
- CVE-2026-107168Medium
A flaw was found in m17n-lib. By providing crafted input containing an invalid UTF-8 character sequence, an attacker can cause the text parsing function to enter an infinite loop. This issue leads to sustained high CPU utilization, resulting in a Denial of Service (DoS) for the affected application.
- CVE-2026-109854Low
A flaw was found in m17n-lib. An attacker who supplies crafted input to an application processing ISO-2022 encoded text can cause the library to read uninitialized memory from the stack. This can result in unexpected behavior and limited information disclosure.
- CVE-2026-107169Medium
A flaw was found in m17n-lib where an attacker could provide specially crafted or truncated UTF-8 input to trigger an unhandled null pointer dereference during text processing. This causes the application to crash unexpectedly, resulting in a Denial of Service (DoS).
Original NVD description (English source)
A flaw was found in m17n-lib. A partial failure during library initialization can leave an internal driver pointer uninitialized. Under specific error conditions, such as system resource exhaustion or database corruption, an application attempting to open an input method dereferences this null pointer without proper validation. This issue causes the application to crash, resulting in a Denial of Service (DoS).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS