CVE-2026-58081: Heap based buffer overflow in iconv(3)
Several encoding modules, including HZ, UTF-7, VIQR, and ZW, did not properly check the size of the caller-supplied output buffer before writing converted characters.
An application that uses iconv(3) to convert untrusted input to or from one of the affected encodings may be vulnerable to buffer overflows if it uses one of the affected encoding modules.
Affected Software
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications may be exposed if they use iconv(3) to convert untrusted input to or from HZ, UTF-7, VIQR, ZW, or another affected encoding module. The issue depends on use of an affected conversion path and a caller-supplied output buffer.
What must an attacker control to exploit the overflow?
An attacker would need to provide input that the application converts using an affected encoding module. The application must perform the conversion with an insufficiently checked caller-supplied output buffer.