Hang Vulnerability in GNU C Library Affecting Multiple Versions
CVE-2026-122054

5.9MEDIUM

Key Information:

Vendor

The Gnu C Library

Status
Glibc
Vendor
CVE Published:
4 November 2026

What is CVE-2026-122054?

A vulnerability in the GNU C Library arises when converting specially crafted BIG-HKSCS input to UCS-4 or the internal wide character encoding using tools such as iconv. This flaw can lead to the converter becoming unresponsive, resulting in the calling application hanging indefinitely. This behavior occurs in specific versions of the GNU C Library, affecting its reliability and potentially disrupting applications that rely on it for standard input handling.

Affected Version(s)

glibc 2.18 <= 2.31

References

https://sourceware.org/bugzilla/show_bug.cgi?id=25734
issue-tracking
https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=ad...
vendor-advisory

CVSS V3.1

Score:
5.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Tom Honermann
.