CVE-2026-102474: Dash Shell Buffer Overflow Vulnerability

CVE-2026-102474 Overview

CVE-2026-102474 is an out-of-bounds write vulnerability in the Debian Almquist Shell (dash). The printf builtin reserves four bytes when converting Unicode \u or \U escape sequences. Multi-byte UTF-8 tokens can require five or six bytes, causing a one or two byte write past the allocated buffer. A local user who supplies a crafted escape sequence to dash printf or echo %b can trigger the overflow. The vulnerability is also reachable through dash -c and positional arguments. The flaw is classified as [CWE-787] Out-of-bounds Write.

Critical Impact
Local attackers can write one or two bytes beyond a reserved buffer through crafted Unicode escapes processed by the dash shell's printf builtin, affecting integrity of shell-invoked processes.

Affected Products

Debian Almquist Shell (dash)
Linux distributions shipping dash as /bin/sh or as a standalone shell
Red Hat Enterprise Linux packages containing dash (see Red Hat CVE-2026-102474 Advisory)

Discovery Timeline

2026-09-29 - CVE-2026-102474 published to NVD
2026-09-29 - Last updated in NVD database

Technical Details for CVE-2026-102474

Vulnerability Analysis

The vulnerability resides in the dash shell's implementation of the printf builtin. When printf processes Unicode escape sequences of the form \u (four hex digits) or \U (eight hex digits), it converts the Unicode code point into its UTF-8 byte representation. The conversion routine pre-allocates four bytes of buffer space per escape based on a fixed reservation.

UTF-8 encoding uses variable byte lengths. Code points above U+FFFF require four bytes, and certain edge cases in the implementation's byte accounting can produce encodings that consume five or six bytes when combined with surrounding token data. The fixed four-byte reservation is therefore insufficient for the widest multi-byte outputs.

Exploitation requires local access with the ability to invoke the shell. The impact is limited to integrity of the running shell process, without direct confidentiality or availability consequences per the published metrics.

Root Cause

The root cause is a static buffer sizing assumption in the printf builtin escape conversion path. The code reserves four bytes before writing UTF-8 output, but the actual encoded token can require up to six bytes. The resulting one or two byte overflow constitutes a heap or stack out-of-bounds write depending on where the reservation lives at runtime. The same defect is reachable through echo %b, which shares the escape processing logic.

Attack Vector

An attacker with local shell access supplies a crafted Unicode escape sequence to printf or echo %b. The escape can be delivered inline through dash -c '...', through a positional argument to a printf format string, or through any script that forwards untrusted input into these builtins. Successful exploitation writes attacker-controlled or attacker-influenced bytes past the reserved buffer, potentially corrupting adjacent memory used by the shell process. See the Red Hat Bug Report #2543004 for technical discussion.

Detection Methods for CVE-2026-102474

Indicators of Compromise

Shell process crashes or unexpected termination in workloads that invoke dash printf or echo %b with externally supplied arguments.
Audit log entries showing dash -c invocations containing long sequences of \u or \U escapes from unprivileged users.
Scripts or web handlers passing untrusted input into printf format arguments handled by /bin/sh when linked to dash.

Detection Strategies

Inventory systems where /bin/sh resolves to dash and enumerate scripts that pass user-controlled data to printf or echo -e/echo %b.
Enable Linux audit rules on execve calls to dash with -c arguments and inspect for suspicious escape patterns.
Compare installed dash package versions against distribution security advisories for CVE-2026-102474.

Monitoring Recommendations

Forward shell execution telemetry and process crash events to a centralized data lake for correlation with user identity and command line arguments.
Alert on repeated segmentation faults originating from dash processes, which may indicate exploitation attempts against the overflow.
Track patch compliance for dash across the Linux fleet through configuration management or endpoint inventory reporting.

How to Mitigate CVE-2026-102474

Immediate Actions Required

Apply the vendor-supplied dash package update as soon as it is available from your Linux distribution.
Review shell scripts that pass externally supplied data into printf format strings and sanitize or reject Unicode escape sequences.
Restrict interactive shell access for untrusted local accounts on multi-tenant systems.

Patch Information

Refer to the Red Hat CVE-2026-102474 Advisory for the current patch status and package versions. Distribution maintainers are expected to backport the upstream fix that corrects the reservation size in the printf Unicode escape handler.

Workarounds

Replace dash with an alternative POSIX shell such as bash for scripts processing untrusted input, where compatibility allows.
Filter or strip \u and \U escape sequences from user-controlled input before passing it to printf or echo %b.
Enforce least-privilege access controls so that local shell execution is limited to trusted users only.

bash

# Verify installed dash version and check for updates
dpkg -l dash 2>/dev/null || rpm -q dash
apt-get update && apt-get install --only-upgrade dash
# or on RHEL-based systems
dnf update dash