Every CVE Search/ Get API key

CVE-2025-26519

musl libc 0.9.13 through 1.2.5 before 1.2.6 has an out-of-bounds write vulnerability when an...

8.1 HighFix available

musl libc 0.9.13 through 1.2.5 before 1.2.6 has an out-of-bounds write vulnerability when an attacker can trigger iconv conversion of untrusted EUC-KR text to UTF-8.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
Low

Exploit likelihood

0.35%Up 0.3 points since Feb 14, 2025
90%50%10%1%

What each source reports

CVE List Score used 8.1

musl libc 0.9.13 through 1.2.5 before 1.2.6 has an out-of-bounds write vulnerability when an attacker can trigger iconv conversion of untrusted EUC-KR text to UTF-8.

Record
CVE-2025-26519
CVSS 3.1
8.1 HighCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L
Weakness
CWE-787
Updated
2026-11-02
EUVDEUVD-2025-4206 8.1

musl libc 0.9.13 through 1.2.5 before 1.2.6 has an out-of-bounds write vulnerability when an attacker can trigger iconv conversion of untrusted EUC-KR text to UTF-8.

Record
EUVD-2025-4206
CVSS 3.1
8.1 HighCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L
Updated
2026-11-02
GitHub AdvisoriesGHSA-xpv5-92cc-8f65 8.1

musl libc 0.9.13 through 1.2.5 before 1.2.6 has an out-of-bounds write vulnerability when an...

musl libc 0.9.13 through 1.2.5 before 1.2.6 has an out-of-bounds write vulnerability when an attacker can trigger iconv conversion of untrusted EUC-KR text to UTF-8.

Record
GHSA-xpv5-92cc-8f65
CVSS 3.1
8.1 HighCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L
Weakness
CWE-787
Updated
2026-11-02
NVD 8.1

musl libc 0.9.13 through 1.2.5 before 1.2.6 has an out-of-bounds write vulnerability when an attacker can trigger iconv conversion of untrusted EUC-KR text to UTF-8.

Record
CVE-2025-26519
CVSS 3.1
8.1 HighCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L
CVSS 3.1
7.0 HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-787
Updated
2026-11-02
OSVALPINE-CVE-2025-26519 7.0

musl libc 0.9.13 through 1.2.5 before 1.2.6 has an out-of-bounds write vulnerability when an attacker can trigger iconv conversion of untrusted EUC-KR text to UTF-8.

Record
ALPINE-CVE-2025-26519
CVSS 3.1
7.0 HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVBELL-CVE-2025-26519 7.0
Record
BELL-CVE-2025-26519
CVSS 3.1
7.0 HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 8 moreShow less
OSV 8.1

musl libc 0.9.13 through 1.2.5 before 1.2.6 has an out-of-bounds write vulnerability when an attacker can trigger iconv conversion of untrusted EUC-KR text to UTF-8.

Record
CVE-2025-26519
CVSS 3.1
8.1 HighCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L
Weakness
CWE-787
Updated
2026-11-02
OSVDEBIAN-CVE-2025-26519 7.0

musl libc 0.9.13 through 1.2.5 before 1.2.6 has an out-of-bounds write vulnerability when an attacker can trigger iconv conversion of untrusted EUC-KR text to UTF-8.

Record
DEBIAN-CVE-2025-26519
CVSS 3.1
7.0 HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVOESA-2025-1252 8.1

musl security update

musl is an implementation of the C standard library built on top of the Linux system call API, including interfaces defined in the base language standard, POSIX, and widely agreed-upon extensions. It is lightweight, fast, simple, free, and strives to be correct in the sense of standards conformance and safety.

Security Fix(es):

musl libc 0.9.13 through 1.2.5 before 1.2.6 has an out-of-bounds write vulnerability when an attacker can trigger iconv conversion of untrusted EUC-KR text to UTF-8.(CVE-2025-26519)

Record
OESA-2025-1252
CVSS 3.1
8.1 HighCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L
Updated
2026-11-02
OSVOESA-2025-1253 8.1

musl security update

musl is an implementation of the C standard library built on top of the Linux system call API, including interfaces defined in the base language standard, POSIX, and widely agreed-upon extensions. It is lightweight, fast, simple, free, and strives to be correct in the sense of standards conformance and safety.

Security Fix(es):

musl libc 0.9.13 through 1.2.5 before 1.2.6 has an out-of-bounds write vulnerability when an attacker can trigger iconv conversion of untrusted EUC-KR text to UTF-8.(CVE-2025-26519)

Record
OESA-2025-1253
CVSS 3.1
8.1 HighCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L
Updated
2026-11-02
OSVOESA-2025-1254 8.1

musl security update

musl is an implementation of the C standard library built on top of the Linux system call API, including interfaces defined in the base language standard, POSIX, and widely agreed-upon extensions. It is lightweight, fast, simple, free, and strives to be correct in the sense of standards conformance and safety.

Security Fix(es):

musl libc 0.9.13 through 1.2.5 before 1.2.6 has an out-of-bounds write vulnerability when an attacker can trigger iconv conversion of untrusted EUC-KR text to UTF-8.(CVE-2025-26519)

Record
OESA-2025-1254
CVSS 3.1
8.1 HighCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L
Updated
2026-11-02
OSVOESA-2025-1255 8.1

musl security update

musl is an implementation of the C standard library built on top of the Linux system call API, including interfaces defined in the base language standard, POSIX, and widely agreed-upon extensions. It is lightweight, fast, simple, free, and strives to be correct in the sense of standards conformance and safety.

Security Fix(es):

musl libc 0.9.13 through 1.2.5 before 1.2.6 has an out-of-bounds write vulnerability when an attacker can trigger iconv conversion of untrusted EUC-KR text to UTF-8.(CVE-2025-26519)

Record
OESA-2025-1255
CVSS 3.1
8.1 HighCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L
Updated
2026-11-02
OSVROOT-OS-ALPINE-315-CVE-2025-26519 7.0

CVE-2025-26519 in musl - Patched by Root

Root has patched CVE-2025-26519 in the musl package for Root:Alpine:3.15. Multiple fixed versions available.

Record
ROOT-OS-ALPINE-315-CVE-2025-26519
CVSS 3.1
7.0 HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2025-26519 8.1

musl libc 0.9.13 through 1.2.5 before 1.2.6 has an out-of-bounds write vulnerability when an attacker can trigger iconv conversion of untrusted EUC-KR text to UTF-8.

Record
UBUNTU-CVE-2025-26519
CVSS 3.1
8.1 HighCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L
CVSS 3.1
7.0 HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
musl
Alpine:v3.16
 0.9.13 up to 1.2.3-r4
1.2.3-r4
musl
Alpine:v3.17
 0.9.13 up to 1.2.3-r6
1.2.3-r6
musl
Alpine:v3.18
 0.9.13 up to 1.2.4-r3
1.2.4-r3
musl
Alpine:v3.19
 0.9.13 up to 1.2.4_git20230717-r5
1.2.4_git20230717-r5
musl
Alpine:v3.20
 0.9.13 up to 1.2.5-r1
1.2.5-r1
musl
Alpine:v3.21
 0.9.13 up to 1.2.5-r9
1.2.5-r9
musl
Alpine:v3.22
 0.9.13 up to 1.2.5-r10
1.2.5-r10
musl
Alpine:v3.23
 0.9.13 up to 1.2.5-r10
1.2.5-r10
musl
Alpine:v3.24
 0.9.13 up to 1.2.5-r10
1.2.5-r10
musl-default
Alpaquita:23
 1.2.3-r11 up to 1.2.4-r12
1.2.4-r12
Show 25 moreShow less
Affected packages
PackageAffectedFixed
musl-perf
Alpaquita:23
 1.2.3-r12 up to 1.2.4-r8
1.2.4-r8
musl-default
Alpaquita:stream
 1.2.4-r0 up to 1.2.5-r12
1.2.5-r12
musl-perf
Alpaquita:stream
 1.2.4-r1 up to 1.2.5-r11
1.2.5-r11
musl-default
BellSoft Hardened Containers:23
 1.2.3-r11 up to 1.2.4-r12
1.2.4-r12
musl-perf
BellSoft Hardened Containers:23
 1.2.3-r12 up to 1.2.4-r8
1.2.4-r8
musl-default
BellSoft Hardened Containers:stream
 1.2.4-r0 up to 1.2.5-r12
1.2.5-r12
musl-perf
BellSoft Hardened Containers:stream
 1.2.4-r1 up to 1.2.5-r11
1.2.5-r11
musl
Debian:12
 All versions, plus listed versions
1.2.3-11.2.4-11.2.4-21.2.5-11.2.5-1.1
Show 5 moreShow less
1.2.5-21.2.5-31.2.5-3.11.2.5-3.1~deb13u11.2.6-1
 None known
musl
Debian:13
 before 1.2.5-2
1.2.5-2
musl
Debian:14
 before 1.2.5-2
1.2.5-2
musl
openEuler:22.03-LTS-SP3
 before 1.2.3-3.oe2203sp3
1.2.3-3.oe2203sp3
musl
openEuler:22.03-LTS-SP4
 before 1.2.3-3.oe2203sp4
1.2.3-3.oe2203sp4
musl
openEuler:24.03-LTS
 before 1.2.4-4.oe2403
1.2.4-4.oe2403
musl
openEuler:24.03-LTS-SP1
 before 1.2.4-4.oe2403sp1
1.2.4-4.oe2403sp1
musl
Root:Alpine:3.15
 before 1.2.2-r90071
1.2.2-r900711.2.2-r90072
rootio-musl
Root:Alpine:3.15
 before 1.2.2-r90071
1.2.2-r900711.2.2-r90072
musl
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
0.9.14-20.9.14-2ubuntu10.9.15-10.9.15-1ubuntu0.1~esm10.9.15-1ubuntu0.1~esm2
 None known
musl
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
1.1.9-11.1.9-1ubuntu0.1~esm21.1.9-1ubuntu0.1~esm3
 None known
musl
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
1.1.16-31.1.18-11.1.19-11.1.19-1ubuntu0.1~esm1
 None known
musl
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
1.1.23-2build11.1.24-11.1.24-1ubuntu0.1~esm1
 None known
musl
Ubuntu:22.04:LTS
 All versions, plus listed versions
1.2.2-11.2.2-4
 None known
musl
Ubuntu:24.04:LTS
 All versions, plus listed versions
1.2.3-11.2.4-2
 None known
musl
Ubuntu:25.10
 All versions, plus listed versions
1.2.5-21.2.5-3
 None known
musl
Ubuntu:26.10
 All versions, plus listed versions
1.2.5-3build11.2.6-1
 None known
musl
Ubuntu:26.04:LTS
 All versions, plus listed versions
1.2.5-31.2.5-3build1
 None known

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-26519 is a high vulnerability (CVSS 8.1) in Musl-libc Musl, published February 14, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.35%, the 28th percentile. Fixed in musl 1.2.3-r4.

References

Show 14 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open