Description
A flaw was found in dash. The printf builtin reserves four bytes before converting a Unicode \u or \U escape, but the multi-byte token can need five or six bytes. A local user who can supply such an escape to dash printf or echo %b, including through dash -c and a positional argument, can write one or two bytes past that reservation.
Published: 2026-09-29
Score: 4 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Local arbitrary write
Action: Apply Patch
AI Analysis

Impact

A flaw in the dash shell’s printf and echo built‑ins permits a local user to supply a Unicode escape sequence that results in a one‑ or two‑byte overrun on the heap. The out‑of‑bounds write occurs during conversion of \u or \U escape tokens when the reserved buffer size is smaller than the multibyte token. This corruption can compromise the integrity of the shell process and may allow the attacker to modify adjacent heap data, potentially breaking the control flow of dash.

Affected Systems

The vulnerability affects the dash shell bundled with Red Hat Enterprise Linux 6. No specific sub‑versions are listed, so any RHEL 6 installation using the default dash is impacted.

Risk and Exploitability

The flaw has a CVSS score of 4, indicating moderate severity. Its EPSS score is below 1 %, suggesting that exploitation is unlikely under current conditions. It is not listed in CISA’s KEV catalog and no public exploits are known. The attack requires local access and the ability to supply crafted input to dash, limiting the risk to local accounts only.

Generated by OpenCVE AI on September 30, 2026 at 03:51 UTC.

Remediation

Vendor Workaround

No practical runtime mitigation is available in the shipped build. Do not pass untrusted data into dash printf/echo %b or into dash -c as a positional argument. The fix is to raise the CHECKSTRSPACE reservation at both printf call sites to 8. The later unaligned-access memcpy change in conv_escape does not enlarge that reservation and does not fix this issue.

OpenCVE Recommended Actions

  • Do not pass untrusted data to dash’s printf or echo %b, and avoid using dash –c with positional arguments that may contain Unicode escapes.
  • Apply the vendor‑released patch that increases the CHECKSTRSPACE reservation from 4 to 8 bytes in the affected printf call sites and in conv_escape.
  • Consider upgrading to a newer operating system release that contains the fixed dash implementation or using a different shell for scripts that need complex escape handling.

Generated by OpenCVE AI on September 30, 2026 at 03:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 01 Oct 2026 07:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 29 Sep 2026 13:15:00 +0000

Type Values Removed Values Added
Description A flaw was found in dash. The printf builtin reserves four bytes before converting a Unicode \u or \U escape, but the multi-byte token can need five or six bytes. A local user who can supply such an escape to dash printf or echo %b, including through dash -c and a positional argument, can write one or two bytes past that reservation.
Title Dash: dash: heap out-of-bounds write in conv_escape via undersized unicode escape reservation
First Time appeared Redhat
Redhat enterprise Linux
Weaknesses CWE-787
CPEs cpe:/o:redhat:enterprise_linux:6
Vendors & Products Redhat
Redhat enterprise Linux
References
Metrics threat_severity

None

 cvssV3_1

{'score': 4, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'}

threat_severity

Moderate

Subscriptions

Redhat Enterprise Linux
cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published:

Updated: 2026-09-29T15:53:05.368Z

Reserved: 2026-09-29T08:38:23.782Z

Link: CVE-2026-102474

cve-icon Vulnrichment

Updated: 2026-09-29T15:52:56.803Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-29T10:17:10.707

Modified: 2026-09-29T21:29:07.663

Link: CVE-2026-102474

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-09-29T00:00:00Z

Links: CVE-2026-102474 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-09-30T04:00:15Z

Weaknesses