CVE-2026-80489
Received Received - Intake

Denial of Service in GNU C Library

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: GNU C Library

Description
Converting crafted EUC_JISX0213 input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.3 to 2.44 may result in the converter making no progress, causing the calling application to hang. Some EUC_JISX0213 sequences decode to two code points. If the output buffer has room for only the first one, the converter stores the second in the conversion state and returns E2BIG, but it never clears that pending character after emitting it on the next call. The converter then keeps emitting the pending character without consuming further input, so an application that retries the conversion loops forever. The input must be attacker controlled and the application must convert it with an output buffer small enough to split the two code points. Only the EUC_JISX0213 character set is affected, which is not commonly used. The related defect in SHIFT_JISX0213 converter is tracked separately as CVE-2026-77117.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-80489
EUVD
EUVD-2026-78411

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
gnu glibc 2.3
gnu glibc 2.44

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-835 The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the GNU C Library versions 2.3 to 2.44. It involves crafted EUC_JISX0213 input that causes the converter to hang when converting to UCS-4 or internal wide character encoding. The issue occurs because the converter stores a pending character in its state and never clears it, leading to an infinite loop if the application retries the conversion with a small output buffer.

Detection Guidance

This vulnerability is specific to the EUC_JISX0213 character set in GNU C Library versions 2.3 to 2.44. Detection would require checking if your system uses glibc in this version range and if applications process EUC_JISX0213 input. No specific commands are provided in the context to detect this issue.

Impact Analysis

This vulnerability can cause applications using the affected GNU C Library to hang indefinitely when processing specific crafted input. This leads to denial-of-service conditions, where the application becomes unresponsive and may require a restart. Only applications using the EUC_JISX0213 character set are affected, which is uncommon.

Mitigation Strategies

Upgrade GNU C Library to version 2.45 or later to address the issue. Avoid using EUC_JISX0213 character set in applications if possible. Monitor for updates from glibc maintainers for patches.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-80489. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart