CVE-2026-102474 PUBLISHED

Dash: dash: heap out-of-bounds write in conv_escape via undersized unicode escape reservation

Assigner: redhat
Reserved: 29.09.2026 Published: 29.09.2026 Updated: 29.09.2026

A flaw was found in dash. The printf builtin reserves four bytes before converting a Unicode \u or \U escape, but the multi-byte token can need five or six bytes. A local user who can supply such an escape to dash printf or echo %b, including through dash -c and a positional argument, can write one or two bytes past that reservation.

Metrics

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS Score: 4

Product Status

Vendor Red Hat
Product Red Hat Enterprise Linux 6
Versions Default: unknown

Workarounds

No practical runtime mitigation is available in the shipped build. Do not pass untrusted data into dash printf/echo %b or into dash -c as a positional argument. The fix is to raise the CHECKSTRSPACE reservation at both printf call sites to 8. The later unaligned-access memcpy change in conv_escape does not enlarge that reservation and does not fix this issue.

Credits

  • Red Hat would like to thank Shubham Raj (Causal Security) for reporting this issue.

References

Problem Types

  • Out-of-bounds Write CWE