CVE-2026-58081
Low risk· EPSS 12%Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
Several encoding modules, including HZ, UTF-7, VIQR, and ZW, did not properly check the size of the caller-supplied output buffer before writing converted characters. An application that uses iconv(3) to convert untrusted input to or from one of the affected encodings may be vulnerable to buffer overflows if it uses one of the affected encoding modules.
Risk Assessment
Applications processing untrusted data with iconv may be exploited to execute arbitrary code or cause a crash.
Recommendation
Apply the vendor patch that fixes the buffer size checks in the mentioned encoding modules.
Original NVD description (English source)
Several encoding modules, including HZ, UTF-7, VIQR, and ZW, did not properly check the size of the caller-supplied output buffer before writing converted characters. An application that uses iconv(3) to convert untrusted input to or from one of the affected encodings may be vulnerable to buffer overflows if it uses one of the affected encoding modules.