Security Flaw in musl libc Affects GB18030 4-byte Decoder Function
CVE-2026-6042

4.8MEDIUM

Key Information:

Vendor

Musl

Status
Libc
Vendor
CVE Published:
10 April 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-6042?

A flaw has been identified in the GB18030 4-byte Decoder function within musl libc, specifically in the iconv implementation located in src/locale/iconv.c. This vulnerability manifests as inefficient algorithmic complexity that can be exploited through localized interactions. Attackers can manipulate this flaw to degrade performance and potentially disrupt user operations. To mitigate the risks associated with this vulnerability, it is essential to apply the recommended patches promptly.

Affected Version(s)

libc 1.2.0

libc 1.2.1

libc 1.2.2

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-6042-PoC
Created by jensnesten

References

https://vuldb.com/vuln/356620
vdb-entrytechnical-description
https://vuldb.com/vuln/356620/cti
signaturepermissions-required
https://vuldb.com/submit/796352
third-party-advisory

CVSS V4

Score:
4.8
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
Low
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

0x001 (VulDB User)
0x001 (VulDB User)
.