CVE-2026-109854: Use of Uninitialized Variable in Red Hat Red Hat Enterprise Linux 10

This vulnerability in m17n-lib occurs when an attacker supplies crafted input to an application that processes ISO-2022 encoded text. The library reads uninitialized memory from the stack due to improper initialization of variables. If the application returns or exposes the decoded output, this can lead to limited information disclosure and unexpected behavior. The CVSS 3.1 base score is 2.5, indicating low severity, with an attack vector of local, high attack complexity, no privileges required, and user interaction required.

The impact is limited information disclosure due to reading uninitialized stack memory. There is no integrity or availability impact. Exploitation requires local access, high attack complexity, and user interaction. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-109854 for current remediation guidance. No specific mitigation steps are provided in the available data.