The vulnerability arises from a flaw in m17n-lib that allows a stack read of uninitialized memory during ISO-2022 compound text UTF-8 decoding. A crafted ISO-2022 encoded input triggers the library to expose data that was never initialized, leading to unexpected behavior and limited leakage of stack contents. This weakness is an example of an uninitialized variable (CWE‑457) and can only reveal information that the uninitialized memory happens to contain.

Red Hat Enterprise Linux 10, 6, 7, 8, and 9 are affected because they ship the vulnerable m17n-lib implementation. Any application on these distributions that processes ISO‑2022 encoded data via the library is susceptible.

The CVSS score of 2.5 classifies this as a low‑severity issue. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. An attacker would need to supply specially crafted input to an application that uses ISO‑2022 decoding. If the application returns or logs the decoded output, the attacker may glean some secret or environment data from the stack. The limited nature of the disclosure and the requirement for intentional input make large‑scale exploitation unlikely, but the risk is still present for exposed services that accept ISO‑2022 input.