CVE-2025-26519
HighSummary
musl libc 0.9.13 through 1.2.5 before 1.2.6 has an out-of-bounds write vulnerability when an attacker can trigger iconv conversion of untrusted EUC-KR text to UTF-8.
Risk Assessment
Risk of memory corruption, which could lead to crashes or potential code execution.
Recommendation
Update musl libc to version 1.2.6 or later.
Other vulnerabilities in musl libc
See all- CVE-2017-15650High
Musl libc before 1.1.17 has a buffer overflow vulnerability that can be exploited via crafted DNS replies. The dns_parse_callback function in network/lookup_name.c does not restrict the number of addresses, allowing an attacker to send an unexpected number of A records in response to an AAAA query.
- CVE-2026-6042Medium
A security flaw has been discovered in musl libc up to 1.2.6. Affected is the function iconv of the file src/locale/iconv.c of the component GB18030 4-byte Decoder. Performing a manipulation results in inefficient algorithmic complexity. The attack must be initiated from a local position.
- CVE-2015-1817Critical
A stack-based buffer overflow in the inet_pton function in musl libc allows attackers to exploit unspecified impacts. This affects versions from 0.9.15 to 1.0.4 and from 1.1.0 to 1.1.7.
Original NVD description (English source)
musl libc 0.9.13 through 1.2.5 before 1.2.6 has an out-of-bounds write vulnerability when an attacker can trigger iconv conversion of untrusted EUC-KR text to UTF-8.