A null pointer dereference occurs in the m17n-lib function read_mtext_element when it processes specially crafted or truncated UTF‑8 data. The resulting crash causes the calling application to terminate unexpectedly, leading to a denial of service condition for users of that application.

Red Hat Enterprise Linux distributions 6, 7, 8, 9 and 10 are affected because the vulnerability resides in the system libraries supplied by those releases. No specific sub‑version ranges are listed, so the issue applies to all currently supported releases that include the unpatched m17n‑lib.

The CVSS score of 6.2 indicates a moderate severity level, but the EPSS score is not available so the precise exploitation probability cannot be determined. The vulnerability is not included in the CISA KEV catalog. An attacker can exploit it by supplying malformed UTF‑8 data to any process that uses m17n‑lib; if the input originates from a remote source, the attack vector could be remote, otherwise it remains local. No practical workaround has been provided by Red Hat, thus the primary mitigation is to obtain a patched version when it becomes available.