CVE-2026-122054 in glibc
Summary
by MITRE • 11/04/2026
Converting crafted BIG-HKSCS input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.18 through 2.31 may result in the converter making no progress, causing the calling application to hang.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 11/04/2026
The vulnerability identified within the GNU C Library versions ranging from 2.18 through 2.31 represents a significant reliability issue affecting applications that perform character set conversions using tools such as iconv. The core of this flaw lies in the implementation of the BIG-HKSCS to UCS-4 or internal wide character encoding converter. When processing specifically crafted input sequences designed to exploit ambiguities or edge cases within the HKSCS (Hong Kong Standard Communication Script) encoding standard, the conversion logic fails to advance its position pointer correctly. Instead of either successfully converting valid characters or properly rejecting invalid byte sequences with an error code, the converter enters a state where it makes no progress on the input stream. This behavior effectively creates an infinite loop within the character translation routine, as the library repeatedly attempts to process bytes that it cannot resolve but refuses to skip or report as errors.
From a technical perspective, this defect is classified under CWE-835, which describes a logic error resulting in a loop without progress. The root cause stems from insufficient validation and state management within the iconv implementation for the BIG-HKSCS encoding module. In robust character set conversion libraries, invalid or incomplete multi-byte sequences should trigger an immediate return of an EILSEQ (illegal byte sequence) error to the calling application, allowing it to handle the exception gracefully. However, in this vulnerable version range, the converter's state machine gets trapped when encountering certain malformed input patterns that do not strictly conform to expected BIG-HKSCS structures but also do not trigger a definitive invalid character detection path. Consequently, the conversion function continues to iterate over the same bytes indefinitely rather than terminating with an error status.
The operational impact of this vulnerability is primarily centered on denial-of-service conditions for any application relying on the GNU C Library for text processing tasks involving HKSCS encoded data. Since the flaw causes the calling process to hang, it leads to resource exhaustion and unresponsiveness within the affected software. This can be particularly severe in server-side applications that handle user-generated content or external data feeds where encoding formats may vary unpredictably. An attacker could potentially trigger this condition by supplying maliciously crafted input strings encoded in BIG-HKSCS format through any interface exposed to users, such as web forms, file uploads, or API endpoints that process text conversion. The resulting hang consumes CPU cycles and memory resources associated with the thread handling the request, effectively rendering the service unavailable until the process is manually terminated by an administrator or a watchdog mechanism.
This issue aligns with ATT&CK technique T1496, which involves Resource Hijacking through denial of service via resource exhaustion. While not typically classified as a critical security vulnerability like remote code execution due to its local nature and impact on availability rather than confidentiality or integrity, it remains a serious concern for system stability and reliability. The lack of progress in the converter means that even well-intentioned applications can be brought down by accidental malformed input, making this both an exploitable vector for malicious actors and a source of unintentional service disruptions due to poor data quality from external sources.
Mitigation strategies primarily involve upgrading the GNU C Library to version 2.32 or later, where this specific logic error in the BIG-HKSCS converter has been addressed by developers who corrected the state machine behavior to properly handle invalid sequences and prevent infinite loops. For environments where immediate patching is not feasible, administrators should implement input validation layers at the application boundary to sanitize character encodings before they reach the iconv subsystem. Additionally, deploying timeout mechanisms or watchdog services that can detect and restart hung processes provides a defensive layer against this type of denial-of-service condition. It is also advisable for developers using these libraries to ensure their applications include robust error handling routines that check return codes from conversion functions strictly, although in this specific case, the lack of progress means standard error checks may not trigger until an external timeout occurs.