A flaw was found in dash. The printf builtin reserves four bytes before converting a Unicode \u or \U escape, but the multi-byte token can need five… (CVE-2026-102474)

The vulnerability in dash arises from the printf builtin's handling of Unicode escape sequences \u and \U. It reserves four bytes of buffer space before conversion, but certain multi-byte Unicode tokens require five or six bytes. A local attacker supplying such escape sequences via dash printf or echo %b, including through dash -c and positional arguments, can cause a buffer overflow by writing one or two bytes past the reserved buffer. This flaw affects specific dash versions listed, primarily in Ubuntu distributions. The CVSS 3.1 base score is 4.0, indicating medium severity with limited impact on integrity and no impact on confidentiality or availability.

A local user can cause a buffer overflow by supplying specially crafted Unicode escape sequences to dash's printf builtin, potentially leading to memory corruption. The impact is limited to integrity loss without affecting confidentiality or availability. There are no known exploits in the wild for this vulnerability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid running untrusted input through dash's printf builtin with Unicode escape sequences. Monitor vendor channels for updates and apply patches once released.