CVE-2026-122054
Received Received - Intake

GNU C Library Denial of Service via iconv Conversion

Publication date: 2026-11-04

Last updated on: 2026-11-04

Assigner: GNU C Library

Description
Converting crafted BIG-HKSCS input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.18 through 2.31 may result in the converter making no progress, causing the calling application to hang.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-04
Last Modified
2026-11-04
Generated
2026-11-04
AI Q&A
2026-11-04
EPSS Evaluated
N/A
NVD
CVE-2026-122054
EUVD
EUVD-2026-117002

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
The GNU C Library glibc 2.18

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-835 The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves a flaw in the GNU C Library (glibc) versions 2.18 through 2.31. When converting crafted BIG-HKSCS input to UCS-4 or internal wide character encoding using tools like iconv, the converter may fail to make progress. This causes the application to hang indefinitely.

Detection Guidance

This vulnerability may cause applications using iconv with BIG-HKSCS input to hang. Monitor for processes stuck in an unresponsive state, particularly those using glibc's iconv functions. Check system logs for hung processes or timeouts during character conversion tasks.

Impact Analysis

This vulnerability can cause applications using glibc to hang when processing specific crafted input. This leads to denial of service, as affected applications become unresponsive until manually terminated.

Mitigation Strategies

Upgrade glibc to a version beyond 2.31 where this issue is resolved. If upgrading is not immediately possible, avoid processing BIG-HKSCS input with iconv or restrict input sources to trusted data. Monitor affected applications for hangs and restart them if necessary.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-122054. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...