https://seclists.org/oss-sec/2026/q4/517: The GNU C Library security advisories update for 2026-11-04

Q: Which applications are exposed to this issue?

Applications using GNU C Library versions 2.18 through 2.31 are exposed if they convert attacker-controlled input from the BIG5-HKSCS character set to UCS-4 or the internal wide-character encoding, such as through iconv.

Q: What must an attacker control to trigger the problem?

The attacker must control both the input and the encoding used for conversion. The crafted input must include a BIG5-HKSCS double-byte sequence that maps to two Unicode code points.

Q: How can teams determine whether they may be affected?

Check whether affected systems use GNU C Library 2.18 through 2.31 and whether application code accepts untrusted data for BIG5-HKSCS decoding. Conversions involving sequences such as 0x88 0x62 are relevant because they trigger the converter state handling flaw.

Published Nov 4, 2026

Updated

Affected Software

1 affected component

GNU GNU C Library>=2.18<=2.31

Frequently Asked Questions

Which applications are exposed to this issue?

Applications using GNU C Library versions 2.18 through 2.31 are exposed if they convert attacker-controlled input from the BIG5-HKSCS character set to UCS-4 or the internal wide-character encoding, such as through iconv.

What must an attacker control to trigger the problem?

The attacker must control both the input and the encoding used for conversion. The crafted input must include a BIG5-HKSCS double-byte sequence that maps to two Unicode code points.

How can teams determine whether they may be affected?

Check whether affected systems use GNU C Library 2.18 through 2.31 and whether application code accepts untrusted data for BIG5-HKSCS decoding. Conversions involving sequences such as 0x88 0x62 are relevant because they trigger the converter state handling flaw.