CVE-2026-107170

LowCVSS 2.9/10Last modified Oct 7, 2026

Description

A flaw was found in m17n-lib. A partial failure during library initialization can leave an internal driver pointer uninitialized. Under specific error conditions, such as system resource exhaustion or database corruption, an application attempting to open an input method dereferences this null pointer without proper validation. This issue causes the application to crash, resulting in a Denial of Service (DoS).

Metrics

CVSS 3.1 2.9/10CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-476

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Oct 7, 2026
Last modified: Oct 7, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-1071716.9An Hardcoded Cryptographic Key vulnerability existed in Trellix Agent 5.8.4 via mfecryptc.dll leads to Database Decryption by Regular Users.CVE-2026-1071746.4A flaw was found in source-to-image. When unpacking archive files, the application fails to properly sanitize symbolic links pointing to abs CVE-2026-1071755.3MISP contains a defect in its event save workflow that prevents the correlation engine from recalculating correlations when an event's distr CVE-2026-1071766.8A flaw was found in the cluster-samples-operator. The RBAC Role coreos-pull-secret-reader in namespace openshift-config grants get, list, an CVE-2026-1071775.9Express Gateway through 1.16.11 contains a hardcoded cryptographic key vulnerability that allows attackers with datastore access to decrypt CVE-2026-1071786.8The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.16 does not escape gallery lightbox configuration values before printin CVE-2026-107184.6Out of bounds write in openSeaChest’s Trim/Unmap operation in Seagate’s openSeaChest v26.03.0 on all supported platforms allows for writing CVE-2026-1071807.1On MISP instances configured to require TOTP enrolment (Security.otp_required), the enforcement of the mandatory two-factor authentication s CVE-2026-1071818.1Telegram Desktop before 7.2.9 contains an IPC record-separator injection vulnerability in Core::Sandbox that allows remote attackers to inje CVE-2026-1071838.1llama.cpp before b11393 contains a use-after-free and double free vulnerability in common_chat_peg_mapper::map that allows unauthenticated r CVE-2026-1071868.6An unauthenticated user can send a DWR request with isPasswordUppercase as one call method and the next call method can be set to a run work CVE-2026-1071878.5A user can access any database details, such as usernames and passwords by sending a DWR request with a specified workflow rule. The authent