CVE-2026-102474

Dash: dash: heap out-of-bounds write in conv_escape via undersized unicode escape reservation

Published Sep 29, 2026 CVSS 3.1 · 4 Medium EPSS < 1% KEV · Not listed

Description

A flaw was found in dash. The printf builtin reserves four bytes before converting a Unicode \u or \U escape, but the multi-byte token can need five or six bytes. A local user who can supply such an escape to dash printf or echo %b, including through dash -c and a positional argument, can write one or two bytes past that reservation.

Analysis

Technical impact

A flaw in the dash shell’s printf and echo built‑ins permits a local user to supply a Unicode escape sequence that results in a one‑ or two‑byte overrun on the heap. The out‑of‑bounds write occurs during conversion of \u or \U escape tokens when the reserved buffer size is smaller than the multibyte token. This corruption can compromise the integrity of the shell process and may allow the attacker to modify adjacent heap data, potentially breaking the control flow of dash.

Affected Systems

The vulnerability affects the dash shell bundled with Red Hat Enterprise Linux 6. No specific sub‑versions are listed, so any RHEL 6 installation using the default dash is impacted.

Risk and Exploitability

The flaw has a CVSS score of 4, indicating moderate severity. Its EPSS score is below 1 %, suggesting that exploitation is unlikely under current conditions. It is not listed in CISA’s KEV catalog and no public exploits are known. The attack requires local access and the ability to supply crafted input to dash, limiting the risk to local accounts only.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor	Product	Default status	Versions
Red Hat	Red Hat Enterprise Linux 6	unknown	—

No data.

Vendor Product Versions

Dash

Version	Status	Scheme	Platform
`—`	affected	—	—

Red Hat

Enterprise Linux

Version	Status	Scheme	Platform
`—`	affected	—	—

Redhat

Enterprise Linux

Version	Status	Scheme	Platform
`—`	affected	—	—

Remediation

Vendor Workaround

No practical runtime mitigation is available in the shipped build. Do not pass untrusted data into dash printf/echo %b or into dash -c as a positional argument. The fix is to raise the CHECKSTRSPACE reservation at both printf call sites to 8. The later unaligned-access memcpy change in conv_escape does not enlarge that reservation and does not fix this issue.

OpenCVE Recommended Actions

Do not pass untrusted data to dash’s printf or echo %b, and avoid using dash –c with positional arguments that may contain Unicode escapes.
Apply the vendor‑released patch that increases the CHECKSTRSPACE reservation from 4 to 8 bytes in the affected printf call sites and in conv_escape.
Consider upgrading to a newer operating system release that contains the fixed dash implementation or using a different shell for scripts that need complex escape handling.

Generated by OpenCVE AI on September 30, 2026 at 03:51 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.113% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://access.redhat.com/security/cve/CVE-2026-102474
https://bugzilla.redhat.com/show_bug.cgi?id=2543004
https://nvd.nist.gov/vuln/detail/CVE-2026-102474
https://www.cve.org/CVERecord?id=CVE-2026-102474

History

Nov 10, 2026 11:00 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Dash Dash dash Red Hat Red Hat enterprise Linux Redhat enterprise Linux
Vendors & Products		Dash Dash dash Red Hat Red Hat enterprise Linux Redhat enterprise Linux

Nov 5, 2026 4:30 PM First appearance in the feed. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Redhat rhel Els
CPEs	~~cpe:/o:redhat:enterprise_linux:6~~	cpe:/o:redhat:rhel_els:6
Vendors & Products	Redhat enterprise Linux	Redhat rhel Els

Oct 1, 2026 7:30 AM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Sep 29, 2026 1:15 PM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		A flaw was found in dash. The printf builtin reserves four bytes before converting a Unicode \u or \U escape, but the multi-byte token can need five or six bytes. A local user who can supply such an escape to dash printf or echo %b, including through dash -c and a positional argument, can write one or two bytes past that reservation.
Title		Dash: dash: heap out-of-bounds write in conv_escape via undersized unicode escape reservation
First Time appeared		Redhat Redhat enterprise Linux
Weaknesses		CWE-787
CPEs		cpe:/o:redhat:enterprise_linux:6
Vendors & Products		Redhat Redhat enterprise Linux
References		https://access.redhat.com/security/cve/CVE-2026-102474 https://bugzilla.redhat.com/show_bug.cgi?id=2543004 https://nvd.nist.gov/vuln/detail/CVE-2026-102474 https://www.cve.org/CVERecord?id=CVE-2026-102474
Metrics	threat_severity `None`	cvssV3_1 `{'score': 4, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'}` threat_severity `Moderate`