Every CVE Search/ Get API key

CVE-2026-6042

musl libc GB18030 4-byte Decoder iconv.c iconv algorithmic complexity

4.8 MediumPublic exploitFix available

A security flaw has been discovered in musl libc up to 1.2.6. Affected is the function iconv of the file src/locale/iconv.c of the component GB18030 4-byte Decoder. Performing a manipulation results in inefficient algorithmic complexity. The attack must be initiated from a local position. To fix this issue, it is recommended to deploy a patch.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
Low

Exploit likelihood

0.24%Up 0.2 points since Apr 10, 2026
90%50%10%1%

What each source reports

CVE List Score used 4.8

musl libc GB18030 4-byte Decoder iconv.c iconv algorithmic complexity

A security flaw has been discovered in musl libc up to 1.2.6. Affected is the function iconv of the file src/locale/iconv.c of the component GB18030 4-byte Decoder. Performing a manipulation results in inefficient algorithmic complexity. The attack must be initiated from a local position. To fix this issue, it is recommended to deploy a patch.

Record
CVE-2026-6042
CVSS 4.0
4.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X
CVSS 3.1
3.3 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:X/RL:O/RC:C
CVSS 3.0
3.3 LowCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:X/RL:O/RC:C
CVSS 2.0
1.7 AV:L/AC:L/Au:S/C:N/I:N/A:P/E:ND/RL:OF/RC:C
Weakness
CWE-407, CWE-404
Updated
2026-11-02
EUVDEUVD-2026-21354 4.8

A security flaw has been discovered in musl libc up to 1.2.6. Affected is the function iconv of the file src/locale/iconv.c of the component GB18030 4-byte Decoder. Performing a manipulation results in inefficient algorithmic complexity. The attack must be initiated from a local position. To fix this issue, it is recommended to deploy a patch.

Record
EUVD-2026-21354
CVSS 4.0
4.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X
Updated
2026-11-02
GitHub AdvisoriesGHSA-2qh3-3rmv-x43w 4.8

A security flaw has been discovered in musl libc up to 1.2.6. Affected is the function iconv of...

A security flaw has been discovered in musl libc up to 1.2.6. Affected is the function iconv of the file src/locale/iconv.c of the component GB18030 4-byte Decoder. Performing a manipulation results in inefficient algorithmic complexity. The attack must be initiated from a local position. To fix this issue, it is recommended to deploy a patch.

Record
GHSA-2qh3-3rmv-x43w
CVSS 4.0
4.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
3.3 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-404
Updated
2026-11-02
NVD 4.8

A security flaw has been discovered in musl libc up to 1.2.6. Affected is the function iconv of the file src/locale/iconv.c of the component GB18030 4-byte Decoder. Performing a manipulation results in inefficient algorithmic complexity. The attack must be initiated from a local position. To fix this issue, it is recommended to deploy a patch.

Record
CVE-2026-6042
CVSS 4.0
4.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
3.3 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
CVSS 2.0
1.7 LowAV:L/AC:L/Au:S/C:N/I:N/A:P
Weakness
CWE-404, CWE-407
Updated
2026-11-02
OSVALPINE-CVE-2026-6042 4.8

A security flaw has been discovered in musl libc up to 1.2.6. Affected is the function iconv of the file src/locale/iconv.c of the component GB18030 4-byte Decoder. Performing a manipulation results in inefficient algorithmic complexity. The attack must be initiated from a local position. To fix this issue, it is recommended to deploy a patch.

Record
ALPINE-CVE-2026-6042
CVSS 4.0
4.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
OSVBELL-CVE-2026-6042 3.3
Record
BELL-CVE-2026-6042
CVSS 3.1
3.3 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
Show 8 moreShow less
OSVDEBIAN-CVE-2026-6042 4.8

A security flaw has been discovered in musl libc up to 1.2.6. Affected is the function iconv of the file src/locale/iconv.c of the component GB18030 4-byte Decoder. Performing a manipulation results in inefficient algorithmic complexity. The attack must be initiated from a local position. To fix this issue, it is recommended to deploy a patch.

Record
DEBIAN-CVE-2026-6042
CVSS 4.0
4.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
OSVOESA-2026-1927 8.1

musl security update

musl is an implementation of the C standard library built on top of the Linux system call API, including interfaces defined in the base language standard, POSIX, and widely agreed-upon extensions. It is lightweight, fast, simple, free, and strives to be correct in the sense of standards conformance and safety.

Security Fix(es):

An issue was discovered in musl libc 0.7.10 through 1.2.6. Stack-based memory corruption can occur during qsort of very large arrays, due to incorrectly implemented double-word primitives. The number of elements must exceed about seven million, i.e., the 32nd Leonardo number on 32-bit platforms (or the 64th Leonardo number on 64-bit platforms, which is not practical).(CVE-2026-40200)

A security flaw has been discovered in musl libc up to 1.2.6. Affected is the function iconv of the file src/locale/iconv.c of the component GB18030 4-byte Decoder. Performing a manipulation results in inefficient algorithmic complexity. The attack must be initiated from a local position. To fix this issue, it is recommended to deploy a patch.(CVE-2026-6042)

Record
OESA-2026-1927
CVSS 3.1
8.1 HighCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVOESA-2026-1928 8.1

musl security update

musl is an implementation of the C standard library built on top of the Linux system call API, including interfaces defined in the base language standard, POSIX, and widely agreed-upon extensions. It is lightweight, fast, simple, free, and strives to be correct in the sense of standards conformance and safety.

Security Fix(es):

An issue was discovered in musl libc 0.7.10 through 1.2.6. Stack-based memory corruption can occur during qsort of very large arrays, due to incorrectly implemented double-word primitives. The number of elements must exceed about seven million, i.e., the 32nd Leonardo number on 32-bit platforms (or the 64th Leonardo number on 64-bit platforms, which is not practical).(CVE-2026-40200)

A security flaw has been discovered in musl libc up to 1.2.6. Affected is the function iconv of the file src/locale/iconv.c of the component GB18030 4-byte Decoder. Performing a manipulation results in inefficient algorithmic complexity. The attack must be initiated from a local position. To fix this issue, it is recommended to deploy a patch.(CVE-2026-6042)

Record
OESA-2026-1928
CVSS 3.1
8.1 HighCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVOESA-2026-2087 8.1

musl security update

musl is an implementation of the C standard library built on top of the Linux system call API, including interfaces defined in the base language standard, POSIX, and widely agreed-upon extensions. It is lightweight, fast, simple, free, and strives to be correct in the sense of standards conformance and safety.

Security Fix(es):

An issue was discovered in musl libc 0.7.10 through 1.2.6. Stack-based memory corruption can occur during qsort of very large arrays, due to incorrectly implemented double-word primitives. The number of elements must exceed about seven million, i.e., the 32nd Leonardo number on 32-bit platforms (or the 64th Leonardo number on 64-bit platforms, which is not practical).(CVE-2026-40200)

A security flaw has been discovered in musl libc up to 1.2.6. Affected is the function iconv of the file src/locale/iconv.c of the component GB18030 4-byte Decoder. Performing a manipulation results in inefficient algorithmic complexity. The attack must be initiated from a local position. To fix this issue, it is recommended to deploy a patch.(CVE-2026-6042)

Record
OESA-2026-2087
CVSS 3.1
8.1 HighCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVOESA-2026-2088 8.1

musl security update

musl is an implementation of the C standard library built on top of the Linux system call API, including interfaces defined in the base language standard, POSIX, and widely agreed-upon extensions. It is lightweight, fast, simple, free, and strives to be correct in the sense of standards conformance and safety.

Security Fix(es):

An issue was discovered in musl libc 0.7.10 through 1.2.6. Stack-based memory corruption can occur during qsort of very large arrays, due to incorrectly implemented double-word primitives. The number of elements must exceed about seven million, i.e., the 32nd Leonardo number on 32-bit platforms (or the 64th Leonardo number on 64-bit platforms, which is not practical).(CVE-2026-40200)

A security flaw has been discovered in musl libc up to 1.2.6. Affected is the function iconv of the file src/locale/iconv.c of the component GB18030 4-byte Decoder. Performing a manipulation results in inefficient algorithmic complexity. The attack must be initiated from a local position. To fix this issue, it is recommended to deploy a patch.(CVE-2026-6042)

Record
OESA-2026-2088
CVSS 3.1
8.1 HighCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVOESA-2026-2178 8.1

musl security update

musl is an implementation of the C standard library built on top of the Linux system call API, including interfaces defined in the base language standard, POSIX, and widely agreed-upon extensions. It is lightweight, fast, simple, free, and strives to be correct in the sense of standards conformance and safety.

Security Fix(es):

An issue was discovered in musl libc 0.7.10 through 1.2.6. Stack-based memory corruption can occur during qsort of very large arrays, due to incorrectly implemented double-word primitives. The number of elements must exceed about seven million, i.e., the 32nd Leonardo number on 32-bit platforms (or the 64th Leonardo number on 64-bit platforms, which is not practical).(CVE-2026-40200)

A security flaw has been discovered in musl libc up to 1.2.6. Affected is the function iconv of the file src/locale/iconv.c of the component GB18030 4-byte Decoder. Performing a manipulation results in inefficient algorithmic complexity. The attack must be initiated from a local position. To fix this issue, it is recommended to deploy a patch.(CVE-2026-6042)

Record
OESA-2026-2178
CVSS 3.1
8.1 HighCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVROOT-OS-ALPINE-317-CVE-2026-6042 5.5

CVE-2026-6042 in musl - Patched by Root

Root has patched CVE-2026-6042 in the musl package for Root:Alpine:3.17. Multiple fixed versions available.

Record
ROOT-OS-ALPINE-317-CVE-2026-6042
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-6042 4.8

A security flaw has been discovered in musl libc up to 1.2.6. Affected is the function iconv of the file src/locale/iconv.c of the component GB18030 4-byte Decoder. Performing a manipulation results in inefficient algorithmic complexity. The attack must be initiated from a local position. To fix this issue, it is recommended to deploy a patch.

Record
UBUNTU-CVE-2026-6042
CVSS 4.0
4.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
CVSS 3.1
3.3 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
musl
Alpine:v3.19
 before 1.2.4_git20230717-r6
1.2.4_git20230717-r6
musl
Alpine:v3.20
 before 1.2.5-r2
1.2.5-r2
musl
Alpine:v3.21
 before 1.2.5-r10
1.2.5-r10
musl
Alpine:v3.22
 before 1.2.5-r11
1.2.5-r11
musl
Alpine:v3.23
 before 1.2.5-r22
1.2.5-r22
musl
Alpine:v3.24
 before 1.2.6-r1
1.2.6-r1
musl-default
Alpaquita:23
 1.2.3-r11 up to 1.2.4-r14
1.2.4-r14
musl-perf
Alpaquita:23
 1.2.3-r12 up to 1.2.4-r10
1.2.4-r10
musl-default
Alpaquita:25
 1.2.5-r12 up to 1.2.5-r15
1.2.5-r15
musl-perf
Alpaquita:25
 1.2.5-r11 up to 1.2.5-r16
1.2.5-r16
Show 27 moreShow less
Affected packages
PackageAffectedFixed
musl-default
Alpaquita:stream
 1.2.4-r0 up to 1.2.6-r2
1.2.6-r2
musl-perf
Alpaquita:stream
 1.2.4-r1 up to 1.2.6-r2
1.2.6-r2
musl-default
BellSoft Hardened Containers:23
 1.2.3-r11 up to 1.2.4-r14
1.2.4-r14
musl-perf
BellSoft Hardened Containers:23
 1.2.3-r12 up to 1.2.4-r10
1.2.4-r10
musl-default
BellSoft Hardened Containers:25
 1.2.5-r12 up to 1.2.5-r15
1.2.5-r15
musl-perf
BellSoft Hardened Containers:25
 1.2.5-r11 up to 1.2.5-r16
1.2.5-r16
musl-default
BellSoft Hardened Containers:stream
 1.2.4-r0 up to 1.2.6-r2
1.2.6-r2
musl-perf
BellSoft Hardened Containers:stream
 1.2.4-r1 up to 1.2.6-r2
1.2.6-r2
musl
Debian:12
 All versions, plus listed versions
1.2.3-11.2.4-11.2.4-21.2.5-11.2.5-1.1
Show 5 moreShow less
1.2.5-21.2.5-31.2.5-3.11.2.5-3.1~deb13u11.2.6-1
 None known
musl
Debian:13
 before 1.2.5-3.1~deb13u1, plus listed versions
1.2.5-3
1.2.5-3.1~deb13u1
musl
Debian:14
 before 1.2.5-3.1, plus listed versions
1.2.5-31.2.5-3.1~deb13u1
1.2.5-3.1
musl
openEuler:24.03-LTS-SP2
From an advisory covering 2 CVEs
 before 1.2.4-6.oe2403sp2
1.2.4-6.oe2403sp2
musl
openEuler:24.03-LTS-SP3
From an advisory covering 2 CVEs
 before 1.2.4-6.oe2403sp3
1.2.4-6.oe2403sp3
musl
openEuler:24.03-LTS
From an advisory covering 2 CVEs
 before 1.2.4-6.oe2403
1.2.4-6.oe2403
musl
openEuler:24.03-LTS-SP1
From an advisory covering 2 CVEs
 before 1.2.4-6.oe2403sp1
1.2.4-6.oe2403sp1
musl
openEuler:22.03-LTS-SP4
From an advisory covering 2 CVEs
 before 1.2.3-4.oe2203sp4
1.2.3-4.oe2203sp4
musl
Root:Alpine:3.17
 before 1.2.3-r60072
1.2.3-r600721.2.3-r60073
rootio-musl
Root:Alpine:3.17
 before 1.2.3-r60072
1.2.3-r600721.2.3-r60073
musl
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
0.9.14-20.9.14-2ubuntu10.9.15-10.9.15-1ubuntu0.1~esm10.9.15-1ubuntu0.1~esm2
 None known
musl
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
1.1.9-11.1.9-1ubuntu0.1~esm21.1.9-1ubuntu0.1~esm3
 None known
musl
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
1.1.16-31.1.18-11.1.19-11.1.19-1ubuntu0.1~esm1
 None known
musl
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
1.1.23-2build11.1.24-11.1.24-1ubuntu0.1~esm1
 None known
musl
Ubuntu:22.04:LTS
 All versions, plus listed versions
1.2.2-11.2.2-4
 None known
musl
Ubuntu:24.04:LTS
 All versions, plus listed versions
1.2.3-11.2.4-2
 None known
musl
Ubuntu:25.10
 All versions, plus listed versions
1.2.5-21.2.5-3
 None known
musl
Ubuntu:26.10
 All versions, plus listed versions
1.2.5-3build11.2.6-1
 None known
musl
Ubuntu:26.04:LTS
 All versions, plus listed versions
1.2.5-31.2.5-3build1
 None known

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubjensnesten/CVE-2026-6042-PoC2026-04-14

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-6042 is a medium vulnerability (CVSS 4.8) in Musl Libc, published April 10, 2026. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 0.24%, the 14th percentile. Fixed in musl 1.2.4_git20230717-r6.

References

Show 13 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open