CVE-2026-4046

The iconv() function in the GNU C Library versions 2.43 and earlier may crash due to an assertion failure when converting inputs from the IBM1390 or IBM1399 character sets, which may be used to remotely crash an application. This vulnerability can be trivially mitigated by removing the IBM1390 and IBM1399 character sets from systems that do not need them.

The GNU C Library project provides the core libraries for the GNU system and GNU/Linux systems, as well as many other systems that use Linux as the kernel. These libraries provide critical APIs including ISO C11, POSIX.1-2008, BSD, OS-specific APIs and more. These APIs include such foundational facilities as open, read, write, malloc, printf, getaddrinfo, dlopen, pthread_create, crypt, login, exit and more.

Security Fix(es):

The iconv() function in the GNU C Library versions 2.43 and earlier may crash due to an assertion failure when converting inputs from the IBM1390 or IBM1399 character sets, which may be used to remotely crash an application.

This vulnerability can be trivially mitigated by removing the IBM1390 and IBM1399 character sets from systems that do not need them.(CVE-2026-4046)

The GNU C Library project provides the core libraries for the GNU system and GNU/Linux systems, as well as many other systems that use Linux as the kernel. These libraries provide critical APIs including ISO C11, POSIX.1-2008, BSD, OS-specific APIs and more. These APIs include such foundational facilities as open, read, write, malloc, printf, getaddrinfo, dlopen, pthread_create, crypt, login, exit and more.

Security Fix(es):

The iconv() function in the GNU C Library versions 2.43 and earlier may crash due to an assertion failure when converting inputs from the IBM1390 or IBM1399 character sets, which may be used to remotely crash an application.

This vulnerability can be trivially mitigated by removing the IBM1390 and IBM1399 character sets from systems that do not need them.(CVE-2026-4046)

The GNU C Library project provides the core libraries for the GNU system and GNU/Linux systems, as well as many other systems that use Linux as the kernel. These libraries provide critical APIs including ISO C11, POSIX.1-2008, BSD, OS-specific APIs and more. These APIs include such foundational facilities as open, read, write, malloc, printf, getaddrinfo, dlopen, pthread_create, crypt, login, exit and more.

Security Fix(es):

The iconv() function in the GNU C Library versions 2.43 and earlier may crash due to an assertion failure when converting inputs from the IBM1390 or IBM1399 character sets, which may be used to remotely crash an application.

This vulnerability can be trivially mitigated by removing the IBM1390 and IBM1399 character sets from systems that do not need them.(CVE-2026-4046)

The GNU C Library project provides the core libraries for the GNU system and GNU/Linux systems, as well as many other systems that use Linux as the kernel. These libraries provide critical APIs including ISO C11, POSIX.1-2008, BSD, OS-specific APIs and more. These APIs include such foundational facilities as open, read, write, malloc, printf, getaddrinfo, dlopen, pthread_create, crypt, login, exit and more.

Security Fix(es):

The iconv() function in the GNU C Library versions 2.43 and earlier may crash due to an assertion failure when converting inputs from the IBM1390 or IBM1399 character sets, which may be used to remotely crash an application.

This vulnerability can be trivially mitigated by removing the IBM1390 and IBM1399 character sets from systems that do not need them.(CVE-2026-4046)

The GNU C Library project provides the core libraries for the GNU system and GNU/Linux systems, as well as many other systems that use Linux as the kernel. These libraries provide critical APIs including ISO C11, POSIX.1-2008, BSD, OS-specific APIs and more. These APIs include such foundational facilities as open, read, write, malloc, printf, getaddrinfo, dlopen, pthread_create, crypt, login, exit and more.

Security Fix(es):

The iconv() function in the GNU C Library versions 2.43 and earlier may crash due to an assertion failure when converting inputs from the IBM1390 or IBM1399 character sets, which may be used to remotely crash an application.

This vulnerability can be trivially mitigated by removing the IBM1390 and IBM1399 character sets from systems that do not need them.(CVE-2026-4046)

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly.

Security Fix(es):

• glibc: glibc: Denial of Service via iconv() function with specific character sets (CVE-2026-4046)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly.

Security Fix(es):

• glibc: glibc: Denial of Service via iconv() function with specific character sets (CVE-2026-4046)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly.

Security Fix(es):

• glibc: glibc: Incorrect DNS response parsing via crafted DNS server response (CVE-2026-4437)

• glibc: glibc: Invalid DNS hostname returned via gethostbyaddr functions (CVE-2026-4438)

• glibc: glibc: Denial of Service via iconv() function with specific character sets (CVE-2026-4046)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Root has patched CVE-2026-4046 in the rootio-glibc package for Root:Debian:12. Multiple fixed versions available.

Root has patched CVE-2026-4046 in the rootio-glibc package for Root:Ubuntu:22.04. Multiple fixed versions available.

Root has patched CVE-2026-4046 in the rootio-glibc package for Root:Ubuntu:24.04. Multiple fixed versions available.

The iconv() function in the GNU C Library versions 2.43 and earlier may crash due to an assertion failure when converting inputs from the IBM1390 or IBM1399 character sets, which may be used to remotely crash an application. This vulnerability can be trivially mitigated by removing the IBM1390 and IBM1399 character sets from systems that do not need them.

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly.

Security Fix(es):

• glibc: glibc: Denial of Service via iconv() function with specific character sets (CVE-2026-4046)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly.

Security Fix(es):

• glibc: glibc: Denial of Service via iconv() function with specific character sets (CVE-2026-4046)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly.

Security Fix(es):

• glibc: glibc: Incorrect DNS response parsing via crafted DNS server response (CVE-2026-4437)
• glibc: glibc: Invalid DNS hostname returned via gethostbyaddr functions (CVE-2026-4438)
• glibc: glibc: Denial of Service via iconv() function with specific character sets (CVE-2026-4046)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The iconv() function in the GNU C Library versions 2.43 and earlier may crash due to an assertion failure when converting inputs from the IBM1390 or IBM1399 character sets, which may be used to remotely crash an application.

This vulnerability can be trivially mitigated by removing the IBM1390 and IBM1399 character sets from systems that do not need them.

• CVE-2026-4046: iconv: use pending character state in IBM1390/IBM1399 character sets to avoid assertion failure when the output buffer ends between two 4-byte UCS-4 code points of a combined character; add tst-bug33980 regression test

• CVE-2026-4046: fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162891). Minimal backport of the iconvdata/ibm1364.c hunks from upstream commit d6f08d1cf027 (Red Hat glibc-2.28-251.el8_10.37, RHSA-2026:20587) — uses the __count state variable to store the pending 4-byte UCS-4 code point so conversion can resume across output-buffer boundaries.

• CVE-2026-4046: fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162891). Backport of upstream commits from Red Hat glibc-2.28-251.el8_10.37 (RHSA-2026:20587): prerequisite refactors plus the IBM1390/1399 pending-character-state fix.

• CVE-2026-4046: fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162891). Backport of upstream commits from Red Hat glibc-2.28-251.el8_10.37 (RHSA-2026:20587): prerequisite refactors plus the IBM1390/1399 pending-character-state fix.

• CVE-2026-4046: fix reachable assertion (abort) in the IBM1390/IBM1399 iconv modules when the output buffer ends between the two UCS-4 code points of a combined character [BZ #33980] (RHEL-162901). Includes the two upstream _STRING_ARCH_unaligned get/set macro refactors the fix depends on.

These are all security issues fixed in the glibc-2.43-2.1 package on the GA media of openSUSE Tumbleweed.

This update for glibc fixes the following issues

• CVE-2026-4046: assertion failure when converting inputs may be used to remotely crash an application (bsc#1261206).
• CVE-2026-5450: stdio-common: scanf %mc pattern will cause heap overflow when width > 1024 (bsc#1262465).
• CVE-2026-5928: libio: ungetwc could be used to leak data on special conditions (bsc#1262464).

Root has patched CVE-2026-4046 in the rootio-glibc package for Root:Debian:13. Multiple fixed versions available.

This update for glibc-livepatches fixes the following issue:

• CVE-2026-4046: assertion failure when converting inputs may be used to remotely crash an application (bsc#1261209).

This update for glibc-livepatches fixes the following issue:

• CVE-2026-4046: assertion failure when converting inputs may be used to remotely crash an application (bsc#1261209).

This update for glibc-livepatches fixes the following issue:

Security fixes:

• CVE-2026-4046: assertion failure when converting inputs may be used to remotely crash an application (bsc#1261209).

Other fixes:

• Fix problems with livepatches targeting libc-2.31.so instead of libc.so.6 in 15.4 (bsc#1263035).

This update for glibc-livepatches fixes the following issues:

• CVE-2026-4046: Fixed assertion failure when converting inputs may be used to remotely crash an application (bsc#1261209)
• Add support for live-patching the gconv modules sitting in glibc-locale-base or glibc-gconv-modules-extra packages.
• Update json files for current glibc variants that support livepatching.

This update for glibc-livepatches fixes the following issue:

• CVE-2026-4046: assertion failure when converting inputs may be used to remotely crash an application (bsc#1261209).

This update for glibc-livepatches fixes the following issue:

• CVE-2026-4046: assertion failure when converting inputs may be used to remotely crash an application (bsc#1261209).

This update for glibc fixes the following issues

• CVE-2026-4046: assertion failure when converting inputs may be used to remotely crash an application (bsc#1261206).
• CVE-2026-5450: stdio-common: scanf %mc pattern will cause heap overflow when width > 1024 (bsc#1262465).
• CVE-2026-5928: libio: ungetwc could be used to leak data on special conditions (bsc#1262464).

This update for glibc fixes the following issues

• CVE-2026-4046: assertion failure when converting inputs may be used to remotely crash an application (bsc#1261206).
• CVE-2026-5450: stdio-common: scanf %mc pattern will cause heap overflow when width > 1024 (bsc#1262465).
• CVE-2026-5928: libio: ungetwc could be used to leak data on special conditions (bsc#1262464).

This update for glibc fixes the following issues

• CVE-2026-4046: assertion failure when converting inputs may be used to remotely crash an application (bsc#1261206).
• CVE-2026-5450: stdio-common: scanf %mc pattern will cause heap overflow when width > 1024 (bsc#1262465).
• CVE-2026-5928: libio: ungetwc could be used to leak data on special conditions (bsc#1262464).

This update for glibc fixes the following issues

• CVE-2026-4046: assertion failure when converting inputs may be used to remotely crash an application (bsc#1261206).
• CVE-2026-5450: stdio-common: scanf %mc pattern will cause heap overflow when width > 1024 (bsc#1262465).
• CVE-2026-5928: libio: ungetwc could be used to leak data on special conditions (bsc#1262464).

This update for glibc fixes the following issues

• CVE-2026-4046: assertion failure when converting inputs may be used to remotely crash an application (bsc#1261206).
• CVE-2026-5450: stdio-common: scanf %mc pattern will cause heap overflow when width > 1024 (bsc#1262465).
• CVE-2026-5928: libio: ungetwc could be used to leak data on special conditions (bsc#1262464).

This update for glibc fixes the following issues

• CVE-2026-4046: assertion failure when converting inputs may be used to remotely crash an application (bsc#1261206).
• CVE-2026-5450: stdio-common: scanf %mc pattern will cause heap overflow when width > 1024 (bsc#1262465).
• CVE-2026-5928: libio: ungetwc could be used to leak data on special conditions (bsc#1262464).

This update for glibc fixes the following issues

• CVE-2026-4046: assertion failure when converting inputs may be used to remotely crash an application (bsc#1261206).
• CVE-2026-5450: stdio-common: scanf %mc pattern will cause heap overflow when width > 1024 (bsc#1262465).
• CVE-2026-5928: libio: ungetwc could be used to leak data on special conditions (bsc#1262464).

This update for glibc fixes the following issues:

• CVE-2026-5928: libio: Fix ungetwc operating on byte stream (bsc#1262464, BZ #33998)
• CVE-2026-5450: stdio-common: Fix buffer overflow in scanf %mc (bsc#1262465, BZ #34008)
• CVE-2026-4046: Use pending character state in IBM1390, IBM1399 character sets (bsc#1261206, BZ #33980)

This update for glibc fixes the following issues:

• CVE-2026-4046: Use pending character state in IBM1390, IBM1399 character sets (bsc#1261206, BZ #33980)

It was discovered that the GNU C Library iconv function incorrectly handled certain IBM character sets. An attacker could possibly use this issue to cause a denial of service. (CVE-2026-4046)

It was discovered that the GNU C Library DNS functions incorrectly handled certain DNS server responses when using gethostbyaddr or gethostbyaddr_r. An attacker in a privileged network position could possibly use this issue to cause an application to violate DNS specification or obtain incorrect hostname information. This issue only affected Ubuntu 24.04 LTS. (CVE-2026-4437, CVE-2026-4438)

It was discovered that the GNU C Library deprecated debugging functions incorrectly enforced caller-supplied buffer lengths. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2026-5435)

It was discovered that the GNU C Library scanf family of functions contained a heap buffer overflow when processing certain format specifiers. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2026-5450)

It was discovered that the GNU C Library ungetwc function incorrectly handled certain character encodings. An attacker could possibly use this issue to obtain sensitive information or cause a denial of service. (CVE-2026-5928)

It was discovered that the GNU C Library deprecated debugging functions incorrectly validated DNS response record data. An attacker could possibly use this issue to cause a denial of service or obtain sensitive information. (CVE-2026-6238)