CVE-2026-4046: iconv crash due to assertion failure with untrusted input
iconv crash due to assertion failure with untrusted input
Other sources
The iconv() function in the GNU C Library versions 2.43 and earlier may crash due to an assertion failure when converting inputs from the IBM1390 or IBM1399 character sets, which may be used to remotely crash an application.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/glibcto a version that resolves this vulnerability.Fixed in 2.31-13+deb11u14Fixed in 2.36-9+deb12u14Fixed in 2.41-12+deb13u3Fixed in 2.42-17 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.38-20 - Compensating control
Trivially mitigate by removing the IBM1390 and IBM1399 character sets from systems that do not need them (applies to GNU C Library versions 2.43 and earlier).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-4046?
CVE-2026-4046 is considered to have a high severity due to its potential to cause application crashes.
How do I fix CVE-2026-4046?
To mitigate CVE-2026-4046, update to a version of GNU C Library later than 2.43 that includes the necessary patches.
What software is affected by CVE-2026-4046?
CVE-2026-4046 affects the GNU C Library versions up to and including 2.43.
What attack vectors are associated with CVE-2026-4046?
CVE-2026-4046 can be exploited remotely by using untrusted input from specific character sets during conversion.
What impacts can CVE-2026-4046 have on applications?
Exploitation of CVE-2026-4046 can lead to crashes of applications that depend on the affected version of GNU C Library.