CVE-2026-6042
LowCVSS 3.3Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
A security flaw has been discovered in musl libc up to 1.2.6. The iconv function in src/locale/iconv.c, within the GB18030 4-byte Decoder component, is affected. Manipulation results in inefficient algorithmic complexity, and the attack must be initiated from a local position.
Risk Assessment
A local attacker can cause excessive CPU consumption, leading to slowdown or denial of service for applications using musl libc. The risk mainly affects environments processing untrusted data through iconv.
Recommendation
Deploy the available patch for musl libc. Until updated, limit processing of untrusted data through the iconv function.
Other vulnerabilities in musl libc
See all- CVE-2017-15650High
Musl libc before 1.1.17 has a buffer overflow vulnerability that can be exploited via crafted DNS replies. The dns_parse_callback function in network/lookup_name.c does not restrict the number of addresses, allowing an attacker to send an unexpected number of A records in response to an AAAA query.
- CVE-2025-26519High
musl libc 0.9.13 through 1.2.5 before 1.2.6 has an out-of-bounds write vulnerability when an attacker can trigger iconv conversion of untrusted EUC-KR text to UTF-8.
- CVE-2015-1817Critical
A stack-based buffer overflow in the inet_pton function in musl libc allows attackers to exploit unspecified impacts. This affects versions from 0.9.15 to 1.0.4 and from 1.1.0 to 1.1.7.
Original NVD description (English source)
A security flaw has been discovered in musl libc up to 1.2.6. Affected is the function iconv of the file src/locale/iconv.c of the component GB18030 4-byte Decoder. Performing a manipulation results in inefficient algorithmic complexity. The attack must be initiated from a local position. To fix this issue, it is recommended to deploy a patch.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS