CVE-2025-26519
HighSummary
musl libc 0.9.13 through 1.2.5 before 1.2.6 has an out-of-bounds write vulnerability when an attacker can trigger iconv conversion of untrusted EUC-KR text to UTF-8.
Risk Assessment
Risk of memory corruption, which could lead to crashes or potential code execution.
Recommendation
Update musl libc to version 1.2.6 or later.
Other vulnerabilities in musl libc
See all- CVE-2017-15650High
Musl libc before 1.1.17 has a buffer overflow vulnerability that can be exploited via crafted DNS replies. The dns_parse_callback function in network/lookup_name.c does not restrict the number of addresses, allowing an attacker to send an unexpected number of A records in response to an AAAA query.
- CVE-2015-1817Critical
A stack-based buffer overflow in the inet_pton function in musl libc allows attackers to exploit unspecified impacts. This affects versions from 0.9.15 to 1.0.4 and from 1.1.0 to 1.1.7.
- CVE-2026-6042Low
A security flaw has been discovered in musl libc up to 1.2.6. The iconv function in src/locale/iconv.c, within the GB18030 4-byte Decoder component, is affected. Manipulation results in inefficient algorithmic complexity, and the attack must be initiated from a local position.
Original NVD description (English source)
musl libc 0.9.13 through 1.2.5 before 1.2.6 has an out-of-bounds write vulnerability when an attacker can trigger iconv conversion of untrusted EUC-KR text to UTF-8.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS