CVEvulnerability

CVE-2026-102474

4.0 MEDIUM Published 2026-09-29 Modified 2026-09-29 Official page ↗
Status
Awaiting Analysis
Published
2026-09-29
Last modified
2026-09-29
Assigner
[email protected]
CVSS 3.1 ([email protected])
4.0 MEDIUM — CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weaknesses
CWE-787

Description

A flaw was found in dash. The printf builtin reserves four bytes before converting a Unicode \u or \U escape, but the multi-byte token can need five or six bytes. A local user who can supply such an escape to dash printf or echo %b, including through dash -c and a positional argument, can write one or two bytes past that reservation.

Related

Weakness · CWE (1)

  • CWE-787 Out-of-bounds Write weakness

References