Buffer Handling Vulnerability in GNU C Library Affects Input Conversion
CVE-2026-80489

5.9MEDIUM

Key Information:

Vendor

The Gnu C Library

Status
Glibc
Vendor
CVE Published:
15 September 2026

What is CVE-2026-80489?

A vulnerability exists in the GNU C Library where specific input sequences from the EUC_JISX0213 character set can lead to an application hang during conversion to UCS-4 encoding. This issue arises when the output buffer cannot accommodate multiple code points, resulting in the converter failing to process input effectively. When encountering such situations, the conversion process can enter an infinite loop, as it continuously tries to emit a pending character without consuming additional input. This issue is particularly relevant for applications that use the EUC_JISX0213 encoding, which is infrequently implemented in systems.

Affected Version(s)

glibc 2.3 <= 2.44

References

https://sourceware.org/bugzilla/show_bug.cgi?id=34568
issue-tracking
https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=ad...
vendor-advisory

CVSS V3.1

Score:
5.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

AISLE in partnership with Red Hat
.