DEBIAN-CVE-2026-122054: Medium severity debian/glibc vulnerability

Q: What input and conversion path are required to trigger the hang?

An attacker needs to supply crafted BIG-HKSCS input that the application converts to UCS-4 or its internal wide-character encoding, such as through iconv. The affected converter may then make no progress and cause the calling application to hang.

Q: Which GNU C Library versions are affected?

The issue affects GNU C Library versions 2.18 through 2.31.

Q: What is the operational impact of successful exploitation?

The reported impact is denial of service: the calling application can hang. No confidentiality or integrity impact is stated.

Published Nov 4, 2026

Updated

Converting crafted BIG-HKSCS input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.18 through 2.31 may result in the converter making no progress, causing the calling application to hang.

Affected Software

3 affected componentsFixes available

debian/glibc<2.32-1

2.32-1

debian/glibc<2.32-1

2.32-1

debian/glibc<2.32-1

2.32-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/glibc to a version that resolves this vulnerability.
Fixed in 2.32-1

Event History

Nov 4, 2026

CVE Published

via OSV·06:17 PM

Data Sourced

via OSV·06:17 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What input and conversion path are required to trigger the hang?

An attacker needs to supply crafted BIG-HKSCS input that the application converts to UCS-4 or its internal wide-character encoding, such as through iconv. The affected converter may then make no progress and cause the calling application to hang.

Which GNU C Library versions are affected?

The issue affects GNU C Library versions 2.18 through 2.31.

What is the operational impact of successful exploitation?

The reported impact is denial of service: the calling application can hang. No confidentiality or integrity impact is stated.

DEBIAN-CVE-2026-122054: Medium severity debian/glibc vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

What input and conversion path are required to trigger the hang?

Which GNU C Library versions are affected?

What is the operational impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

What input and conversion path are required to trigger the hang?

Which GNU C Library versions are affected?

What is the operational impact of successful exploitation?