CVE-2026-122054: BIG-HKSCS decoding hang on crafted input
Converting crafted BIG-HKSCS input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.18 through 2.31 may result in the converter making no progress, causing the calling application to hang.
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications using GNU C Library versions 2.18 through 2.31 are affected when they convert attacker-controlled BIG-HKSCS input to UCS-4 or the internal wide-character encoding, such as through iconv.
What does an attacker need to do to trigger the hang?
An attacker needs to provide crafted BIG-HKSCS input that is processed by a vulnerable conversion path. No privileges or user interaction are required, but the attack complexity is rated high.
What is the practical impact?
The converter can make no progress, causing the calling application to hang. The provided vector indicates an availability impact only, with no confidentiality or integrity impact.