CVE-2019-18224

CriticalCVSS 9.8

Published: 21/10/2019(UTC)Updated: 14/10/2026(UTC)Translated: 14/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

High risk

3.71%

90th percentile - higher than 90% of all known CVEs

Summary

In GNU libidn2 before 2.1.1, the idn2_to_ascii_4i function in lib/lookup.c has a heap-based buffer overflow. The vulnerability is triggered by a long domain string.

Risk Assessment

An attacker may cause a heap-based buffer overflow, potentially leading to arbitrary code execution or a crash in applications processing untrusted domain names.

Recommendation

Update GNU libidn2 to version 2.1.1 or later.

Other vulnerabilities in GNU libidn2

CVE-2019-12290High
GNU libidn2 before 2.2.0 fails to perform the roundtrip checks specified in RFC3490 Section 4.2 when converting A-labels to U-labels. This makes it possible in some circumstances for one domain to impersonate another. By creating a malicious domain that matches a target domain except for the inclusion of certain punycoded Unicode characters (that would be discarded when converted first to a Unicode label and then back to an ASCII label), arbitrary domains can be impersonated.

Original NVD description (English source)

idn2_to_ascii_4i in lib/lookup.c in GNU libidn2 before 2.1.1 has a heap-based buffer overflow via a long domain string.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS