CVE-2026-77117
Received Received - Intake

Denial of Service in GNU C Library

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: GNU C Library

Description
Converting crafted SHIFT_JISX0213 input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.3 to 2.44 may result in the converter making no progress, causing the calling application to hang. Some SHIFT_JISX0213 sequences decode to two code points. If the output buffer has room for only the first one, the converter stores the second in the conversion state and returns E2BIG, but it never clears that pending character after emitting it on the next call. The converter then keeps emitting the pending character without consuming further input, so an application that retries the conversion loops forever. The input must be attacker controlled and the application must convert it with an output buffer small enough to split the two code points. Only the SHIFT_JISX0213 character set is affected, which is not commonly used. The related defect in the EUC_JISX0213 converter is tracked separately as CVE-2026-80489.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-77117
EUVD
EUVD-2026-78409

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
gnu glibc 2.3
gnu glibc 2.44

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-835 The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves a flaw in the GNU C Library's SHIFT_JISX0213 character set converter. When converting crafted input to UCS-4 or internal encoding, the converter may hang if the output buffer is too small. The issue occurs because the converter stores a pending character in its state and repeatedly emits it without processing further input, causing an infinite loop.

Detection Guidance

This vulnerability is specific to the GNU C Library's handling of SHIFT_JISX0213 encoding. Detection requires checking the glibc version and testing applications that use iconv with SHIFT_JISX0213 input. Commands like 'ldd --version' or 'libc.so.6' can verify glibc version. Test with 'iconv -f SHIFT_JISX0213 -t UTF-8' on crafted input to observe hangs.

Impact Analysis

An attacker could exploit this to cause a denial of service by making applications hang indefinitely. This requires attacker-controlled input and a specific output buffer size. Only systems using SHIFT_JISX0213 encoding are affected, which is uncommon.

Mitigation Strategies

Upgrade glibc to version 2.45 or later. If upgrading is not possible, avoid using SHIFT_JISX0213 encoding in iconv. Apply patches from your distribution if available. Monitor applications using iconv for unexpected hangs during encoding conversions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-77117. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart