A flaw was found in m17n-lib. A partial failure during library initialization can leave an internal driver pointer uninitialized. (CVE-2026-107170)
Description
A vulnerability in m17n-lib can cause a denial of service due to a null pointer dereference during library initialization failure. This occurs under specific error conditions like resource exhaustion or database corruption when an application opens an input method. The flaw affects multiple specific versions of m17n-lib and results in application crashes without impacting confidentiality or integrity.
CVSS v3.1
Score 2.9low
Affected software
pkg:deb/ubuntu/m17n-lib?arch=source&distro=xenialpkg:deb/ubuntu/m17n-lib?arch=source&distro=bionicpkg:deb/ubuntu/m17n-lib?arch=source&distro=focalpkg:deb/ubuntu/m17n-lib?arch=source&distro=jammypkg:deb/ubuntu/m17n-lib?arch=source&distro=noblepkg:deb/ubuntu/m17n-lib?arch=source&distro=stonkingpkg:deb/ubuntu/m17n-lib?arch=source&distro=resoluteRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-107170 describes a flaw in m17n-lib where a partial failure during library initialization leaves an internal driver pointer uninitialized. When an application attempts to open an input method under certain error conditions, such as system resource exhaustion or database corruption, it dereferences this null pointer without validation. This leads to a denial of service via application crash. The vulnerability has a CVSS 3.1 base score of 2.9, indicating low impact on confidentiality and integrity but causing availability disruption.
Potential Impact
The vulnerability causes denial of service by crashing applications that use the affected m17n-lib versions when opening input methods under error conditions. There is no impact on confidentiality or integrity. The attack vector is local with high attack complexity and no privileges required.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid conditions that may trigger partial initialization failures, such as resource exhaustion or database corruption.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- UBUNTU-CVE-2026-107170
- Osv Schema Version
- 1.7.0
- Ecosystems
- ["Ubuntu:16.04:LTS","Ubuntu:18.04:LTS","Ubuntu:20.04:LTS","Ubuntu:22.04:LTS","Ubuntu:24.04:LTS","Ubuntu:26.10","Ubuntu:26.04:LTS"]
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6ad3f4e12cdf04f656656d1a
Added to database: 10/17/2026, 22:21:21 UTC
Last enriched: 10/17/2026, 22:35:08 UTC
Last updated: 10/17/2026, 22:35:08 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.