{"id":"CVE-2025-26519","aliases":["ALPINE-CVE-2025-26519","BELL-CVE-2025-26519","DEBIAN-CVE-2025-26519","EUVD-2025-4206","GHSA-xpv5-92cc-8f65","OESA-2025-1252","OESA-2025-1253","OESA-2025-1254","OESA-2025-1255","ROOT-OS-ALPINE-315-CVE-2025-26519","UBUNTU-CVE-2025-26519"],"status":"published","title":"musl libc 0.9.13 through 1.2.5 before 1.2.6 has an out-of-bounds write vulnerability when an...","description":"musl libc 0.9.13 through 1.2.5 before 1.2.6 has an out-of-bounds write vulnerability when an attacker can trigger iconv conversion of untrusted EUC-KR text to UTF-8.","severity":{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00349,"percentile":0.28915,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-787"],"published":"2025-02-14T00:00:00Z","modified":"2026-10-28T11:01:08Z","fixes":[{"ecosystem":"Alpine:v3.16","package":"musl","fixed_in":["1.2.3-r4"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"musl","fixed_in":["1.2.3-r6"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"musl","fixed_in":["1.2.4-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"musl","fixed_in":["1.2.4_git20230717-r5"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"musl","fixed_in":["1.2.5-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"musl","fixed_in":["1.2.5-r9"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"musl","fixed_in":["1.2.5-r10"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"musl","fixed_in":["1.2.5-r10"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"musl","fixed_in":["1.2.5-r10"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"musl-default","fixed_in":["1.2.4-r12"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"musl-perf","fixed_in":["1.2.4-r8"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"musl-default","fixed_in":["1.2.5-r12"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"musl-perf","fixed_in":["1.2.5-r11"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:23","package":"musl-default","fixed_in":["1.2.4-r12"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:23","package":"musl-perf","fixed_in":["1.2.4-r8"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:stream","package":"musl-default","fixed_in":["1.2.5-r12"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:stream","package":"musl-perf","fixed_in":["1.2.5-r11"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"musl","fixed_in":["1.2.5-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"musl","fixed_in":["1.2.5-2"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP3","package":"musl","fixed_in":["1.2.3-3.oe2203sp3"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"musl","fixed_in":["1.2.3-3.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"musl","fixed_in":["1.2.4-4.oe2403"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"musl","fixed_in":["1.2.4-4.oe2403sp1"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.15","package":"musl","fixed_in":["1.2.2-r90071","1.2.2-r90072"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.15","package":"rootio-musl","fixed_in":["1.2.2-r90071","1.2.2-r90072"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.16","package":"musl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.9.13"},{"fixed":"1.2.3-r4"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"musl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.9.13"},{"fixed":"1.2.3-r6"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"musl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.9.13"},{"fixed":"1.2.4-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"musl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.9.13"},{"fixed":"1.2.4_git20230717-r5"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"musl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.9.13"},{"fixed":"1.2.5-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"musl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.9.13"},{"fixed":"1.2.5-r9"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"musl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.9.13"},{"fixed":"1.2.5-r10"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"musl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.9.13"},{"fixed":"1.2.5-r10"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"musl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.9.13"},{"fixed":"1.2.5-r10"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"musl-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.2.3-r11"},{"fixed":"1.2.4-r12"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"musl-perf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.2.3-r12"},{"fixed":"1.2.4-r8"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"musl-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.2.4-r0"},{"fixed":"1.2.5-r12"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"musl-perf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.2.4-r1"},{"fixed":"1.2.5-r11"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:23","package":"musl-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.2.3-r11"},{"fixed":"1.2.4-r12"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:23","package":"musl-perf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.2.3-r12"},{"fixed":"1.2.4-r8"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:stream","package":"musl-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.2.4-r0"},{"fixed":"1.2.5-r12"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:stream","package":"musl-perf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.2.4-r1"},{"fixed":"1.2.5-r11"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"musl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.3-1","1.2.4-1","1.2.4-2","1.2.5-1","1.2.5-1.1","1.2.5-2","1.2.5-3","1.2.5-3.1","1.2.5-3.1~deb13u1","1.2.6-1"]},{"source":"osv","ecosystem":"Debian:13","package":"musl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.5-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"musl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.5-2"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"musl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.3-3.oe2203sp3"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"musl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.3-3.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"musl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.4-4.oe2403"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"musl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.4-4.oe2403sp1"}]}]},{"source":"osv","ecosystem":"Root:Alpine:3.15","package":"musl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.2-r90071"},{"fixed":"1.2.2-r90072"}]}]},{"source":"osv","ecosystem":"Root:Alpine:3.15","package":"rootio-musl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.2-r90071"},{"fixed":"1.2.2-r90072"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"musl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.14-2","0.9.14-2ubuntu1","0.9.15-1","0.9.15-1ubuntu0.1~esm1","0.9.15-1ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"musl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.9-1","1.1.9-1ubuntu0.1~esm2","1.1.9-1ubuntu0.1~esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"musl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.16-3","1.1.18-1","1.1.19-1","1.1.19-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"musl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.23-2build1","1.1.24-1","1.1.24-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"musl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.2-1","1.2.2-4"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"musl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.3-1","1.2.4-2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"musl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.5-2","1.2.5-3"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"musl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.5-3build1","1.2.6-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"musl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.5-3","1.2.5-3build1"]}],"products":[{"vendor":"musl-libc","product":"musl"}],"references":[{"url":"https://git.musl-libc.org/cgit/musl/commit/?id=e5adcd97b5196e29991b524237381a0202a60659","tags":["Patch","web","report"]},{"url":"https://www.openwall.com/lists/oss-security/2025/02/13/2","tags":["Mailing List","Mitigation","Third Party Advisory","web","report"]},{"url":"https://git.musl-libc.org/cgit/musl/commit/?id=c47ad25ea3b484e10326f933e927c0bc8cded3da","tags":["Patch","web","report"]},{"url":"http://www.openwall.com/lists/oss-security/2025/02/13/2","tags":["Mailing List","Mitigation","Third Party Advisory","web","report"]},{"url":"http://www.openwall.com/lists/oss-security/2025/02/13/3","tags":["Mailing List","Third Party Advisory","web","report"]},{"url":"http://www.openwall.com/lists/oss-security/2025/02/13/4","tags":["Mailing List","Mitigation","Third Party Advisory","web","report"]},{"url":"http://www.openwall.com/lists/oss-security/2025/02/13/5","tags":["Mailing List","Mitigation","Third Party Advisory","web","report"]},{"url":"http://www.openwall.com/lists/oss-security/2025/02/14/5","tags":["Mailing List","Third Party Advisory","web"]},{"url":"http://www.openwall.com/lists/oss-security/2025/02/14/6","tags":["Mailing List","Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-26519","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-xpv5-92cc-8f65"},{"url":"https://security.alpinelinux.org/vuln/CVE-2025-26519","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2025-26519","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/26xxx/CVE-2025-26519.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-26519","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1252","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1253","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1254","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1255","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-26519","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-26519","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2025-26519","description":"musl libc 0.9.13 through 1.2.5 before 1.2.6 has an out-of-bounds write vulnerability when an attacker can trigger iconv conversion of untrusted EUC-KR text to UTF-8.","status":"published","published":"2025-02-14T00:00:00Z","modified":"2025-02-14T17:02:39.47Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L","level":"high","assessor":"cna"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:32:28.250136Z"}],"euvd":[{"id":"EUVD-2025-4206","description":"musl libc 0.9.13 through 1.2.5 before 1.2.6 has an out-of-bounds write vulnerability when an attacker can trigger iconv conversion of untrusted EUC-KR text to UTF-8.","status":"published","published":"2025-02-14T00:00:00Z","modified":"2025-02-14T17:02:39Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T20:53:30.344132Z"}],"ghsa":[{"id":"GHSA-xpv5-92cc-8f65","title":"musl libc 0.9.13 through 1.2.5 before 1.2.6 has an out-of-bounds write vulnerability when an...","description":"musl libc 0.9.13 through 1.2.5 before 1.2.6 has an out-of-bounds write vulnerability when an attacker can trigger iconv conversion of untrusted EUC-KR text to UTF-8.","status":"published","published":"2025-02-14T06:30:36Z","modified":"2025-02-14T18:30:51Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L","level":"high"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:59:57.099053Z"}],"nvd":[{"id":"CVE-2025-26519","description":"musl libc 0.9.13 through 1.2.5 before 1.2.6 has an out-of-bounds write vulnerability when an attacker can trigger iconv conversion of untrusted EUC-KR text to UTF-8.","status":"published","published":"2025-02-14T04:15:09.05Z","modified":"2026-06-17T09:01:57.26Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L","level":"high","assessor":"secondary"},{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:10:51.445921Z"}],"osv":[{"id":"ALPINE-CVE-2025-26519","description":"musl libc 0.9.13 through 1.2.5 before 1.2.6 has an out-of-bounds write vulnerability when an attacker can trigger iconv conversion of untrusted EUC-KR text to UTF-8.","status":"published","published":"2025-02-14T04:15:09.05Z","modified":"2026-08-27T22:18:02.852041325Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:27:49.709457Z"},{"id":"BELL-CVE-2025-26519","status":"published","published":"2025-02-14T15:20:28.4113Z","modified":"2026-01-26T09:38:57.779445Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:21.491466Z"},{"id":"CVE-2025-26519","description":"musl libc 0.9.13 through 1.2.5 before 1.2.6 has an out-of-bounds write vulnerability when an attacker can trigger iconv conversion of untrusted EUC-KR text to UTF-8.","status":"published","published":"2025-02-14T00:00:00Z","modified":"2026-10-28T11:01:08.444669783Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L","level":"high"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T15:44:47.386092Z"},{"id":"DEBIAN-CVE-2025-26519","description":"musl libc 0.9.13 through 1.2.5 before 1.2.6 has an out-of-bounds write vulnerability when an attacker can trigger iconv conversion of untrusted EUC-KR text to UTF-8.","status":"published","published":"2025-02-14T04:15:09.05Z","modified":"2026-09-01T20:05:44.849391356Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:45.870237Z"},{"id":"OESA-2025-1252","title":"musl security update","description":"musl is an implementation of the C standard library built on top of the Linux system call API, including interfaces defined in the base language standard, POSIX, and widely agreed-upon extensions. It is lightweight, fast, simple, free, and strives to be correct in the sense of standards conformance and safety.\r\n\r\nSecurity Fix(es):\n\nmusl libc 0.9.13 through 1.2.5 before 1.2.6 has an out-of-bounds write vulnerability when an attacker can trigger iconv conversion of untrusted EUC-KR text to UTF-8.(CVE-2025-26519)","status":"published","published":"2025-03-07T11:08:21Z","modified":"2026-08-18T01:18:48.548916833Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T15:52:42.714349Z"},{"id":"OESA-2025-1253","title":"musl security update","description":"musl is an implementation of the C standard library built on top of the Linux system call API, including interfaces defined in the base language standard, POSIX, and widely agreed-upon extensions. It is lightweight, fast, simple, free, and strives to be correct in the sense of standards conformance and safety.\r\n\r\nSecurity Fix(es):\n\nmusl libc 0.9.13 through 1.2.5 before 1.2.6 has an out-of-bounds write vulnerability when an attacker can trigger iconv conversion of untrusted EUC-KR text to UTF-8.(CVE-2025-26519)","status":"published","published":"2025-03-07T11:08:21Z","modified":"2026-08-18T01:18:48.412728345Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T15:52:42.714349Z"},{"id":"OESA-2025-1254","title":"musl security update","description":"musl is an implementation of the C standard library built on top of the Linux system call API, including interfaces defined in the base language standard, POSIX, and widely agreed-upon extensions. It is lightweight, fast, simple, free, and strives to be correct in the sense of standards conformance and safety.\r\n\r\nSecurity Fix(es):\n\nmusl libc 0.9.13 through 1.2.5 before 1.2.6 has an out-of-bounds write vulnerability when an attacker can trigger iconv conversion of untrusted EUC-KR text to UTF-8.(CVE-2025-26519)","status":"published","published":"2025-03-07T11:08:21Z","modified":"2026-08-18T01:18:48.399202279Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T15:52:42.714349Z"},{"id":"OESA-2025-1255","title":"musl security update","description":"musl is an implementation of the C standard library built on top of the Linux system call API, including interfaces defined in the base language standard, POSIX, and widely agreed-upon extensions. It is lightweight, fast, simple, free, and strives to be correct in the sense of standards conformance and safety.\r\n\r\nSecurity Fix(es):\n\nmusl libc 0.9.13 through 1.2.5 before 1.2.6 has an out-of-bounds write vulnerability when an attacker can trigger iconv conversion of untrusted EUC-KR text to UTF-8.(CVE-2025-26519)","status":"published","published":"2025-03-07T11:08:21Z","modified":"2026-08-18T01:18:48.458091967Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T15:52:42.714349Z"},{"id":"ROOT-OS-ALPINE-315-CVE-2025-26519","title":"CVE-2025-26519 in musl - Patched by Root","description":"Root has patched CVE-2025-26519 in the musl package for Root:Alpine:3.15. Multiple fixed versions available.","status":"published","published":"2026-09-29T09:32:47Z","modified":"2026-09-29T10:15:05.824273871Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:28.259095Z"},{"id":"UBUNTU-CVE-2025-26519","description":"musl libc 0.9.13 through 1.2.5 before 1.2.6 has an out-of-bounds write vulnerability when an attacker can trigger iconv conversion of untrusted EUC-KR text to UTF-8.","status":"published","published":"2025-02-14T04:15:00Z","modified":"2026-10-17T12:57:26.965589407Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L","level":"high"},{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:55:26.330196Z"}]}}