CVE-2026-109854

Name	CVE-2026-109854
Description	A flaw was found in m17n-lib. An attacker who supplies crafted input to an application processing ISO-2022 encoded text can cause the library to read uninitialized memory from the stack. If the application exposes or returns the decoded output, this flaw can result in unexpected behavior and limited information disclosure.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1150903

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
m17n-lib (PTS)	bookworm	1.8.0-6	vulnerable
	trixie	1.8.5-1	vulnerable
	forky	1.8.6-1	vulnerable
	sid	1.8.7-1	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
m17n-lib	source	(unstable)	(unfixed)			1150903

Notes

[trixie] - m17n-lib <no-dsa> (Minor issue)
https://lists.gnu.org/archive/html/m17n-list/2026-10/msg00001.html
https://cgit.git.savannah.nongnu.org/cgit/m17n/m17n-lib.git/commit/?id=f3b85087f90189f91c04ba1b62c5f0b879ff2b20