A flaw was discovered in the m17n-lib library, a component used by many Red Hat Enterprise Linux distributions to provide language support. The vulnerability appears during input-method state transitions: an internal input context object is freed, yet the library subsequently attempts to write to that same heap region. This heap use-after-free (CWE-416) can cause applications that link against m17n-lib to crash, producing a denial of service. Under specific circumstances, an attacker could also trigger arbitrary code execution by sending specially crafted text input.

The defect affects all supported Red Hat Enterprise Linux major releases: versions 6 through 10, including RHEL 6, 7, 8, 9 and 10. No precise library version is identified, and the CVE entry does not list any patch or update at present. Systems running these distributions should determine whether the vulnerable library is present in their environment and identify any applications that depend on it.

The CVSS score of 6.2 denotes moderate severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. The attacker must supply specially crafted input to trigger a state transition; therefore the attack vector is largely ‘local’ to a process that receives user data. The lack of a public patch means the primary risk remains a crash‑driven DoS unless the application handles the crash gracefully. Users should continue to monitor for related advisories and consider defensive coding strategies.