Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-107170: Red Hat Enterprise Linux input method crash causes service outage

CVE-2026-107170 · published 11 days ago

Summary

The m17n-lib component used in Red Hat Enterprise Linux versions 6 through 10 can crash when the system runs out of resources or the database is damaged. This crash stops applications that rely on input methods, leading to a temporary loss of service. Update the system with the latest patches from Red Hat to prevent the crash.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Ecosystem	Vendor	Product	Affected versions
–	red hat	red hat enterprise linux 10	All versions
–	red hat	red hat enterprise linux 6	All versions
–	red hat	red hat enterprise linux 7	All versions
–	red hat	red hat enterprise linux 8	All versions
–	red hat	red hat enterprise linux 9	All versions
Debian:12	debian	m17n-lib	All versions
Ubuntu:16.04:LTS	canonical	m17n-lib	All versions

Original advisory text

DEBIAN-CVE-2026-107170

A flaw was found in m17n-lib. A partial failure during library initialization can leave an internal driver pointer uninitialized. Under specific error conditions, such as system resource exhaustion or database corruption, an application attempting to open an input method dereferences this null pointer without proper validation. This issue causes the application to crash, resulting in a Denial of Service (DoS).

References

https://access.redhat.com/security/cve/CVE-2026-107170 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2547411 Third Party Advisory
https://security-tracker.debian.org/tracker/CVE-2026-107170 Vendor Advisory
https://ubuntu.com/security/CVE-2026-107170 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-107170 Third Party Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

2.9 Low

Exploitation

<1% chance of attack within 30 days

Type

CWE-476NULL Pointer Dereference

Timeline

Published7 Oct 2026

Updated17 Oct 2026

First seen7 Oct 2026

Sources

CVE-2026-107170 · NVD

CVE-2026-107170 · MITRE

DEBIAN-CVE-2026-107170 · OSV

UBUNTU-CVE-2026-107170 · OSV

Track software like this

Free during beta