Conversion Error in GNU C Library Affects Multiple Versions
CVE-2026-77117

5.9MEDIUM

Key Information:

Vendor

The Gnu C Library

Status
Glibc
Vendor
CVE Published:
15 September 2026

What is CVE-2026-77117?

An error in the conversion of crafted SHIFT_JISX0213 input to UCS-4 or another internal wide character encoding in the GNU C Library can lead to application hangs. This occurs when the output buffer is insufficient to handle sequences that decode to two code points. When the converter encounters limited buffer space, it retains one of the code points in its internal state, returning an error while failing to clear it. As a result, the converter may continuously emit this pending character without processing any new input, effectively causing infinite loops in applications that attempt to re-initiate the conversion. This vulnerability specifically affects applications using the SHIFT_JISX0213 character set during input conversion.

Affected Version(s)

glibc 2.3 <= 2.44

References

https://sourceware.org/bugzilla/show_bug.cgi?id=34556
issue-tracking
https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=ad...
vendor-advisory

CVSS V3.1

Score:
5.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

AISLE in partnership with Red Hat
.