CVE-2026-77117 in glibc
Summary
by MITRE • 09/15/2026
Converting crafted SHIFT_JISX0213 input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.3 to 2.44 may result in the converter making no progress, causing the calling application to hang.
Some SHIFT_JISX0213 sequences decode to two code points. If the output buffer has room for only the first one, the converter stores the second in the conversion state and returns E2BIG, but it never clears that pending character after emitting it on the next call. The converter then keeps emitting the pending character without consuming further input, so an application that retries the conversion loops forever. The input must be attacker controlled and the application must convert it with an output buffer small enough to split the two code points. Only the SHIFT_JISX0213 character set is affected, which is not commonly used. The related defect in the EUC_JISX0213 converter is tracked separately as CVE-2026-80489.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/21/2026
The GNU C Library, widely known as glibc, contains a critical logic error within its character set conversion routines that affects versions ranging from 2.3 through 2.44. This vulnerability specifically impacts the handling of SHIFT_JISX0213 encoded input when converting to UCS-4 or internal wide character encodings using tools such as iconv. The core technical flaw resides in how the converter manages state transitions for multi-code point sequences. In the SHIFT_JISX0213 encoding, certain byte sequences are designed to decode into two distinct Unicode code points rather than a single one. When an application attempts to convert these sequences and provides an output buffer that is too small to accommodate both resulting code points simultaneously, the conversion routine correctly identifies this limitation by returning the E2BIG error code, which indicates that the output buffer is insufficient.
However, the implementation fails to properly reset or clear its internal state after encountering this partial success scenario. Specifically, when the converter determines it can only write the first of the two expected code points into the provided buffer, it stores the second pending code point in its conversion state and returns control to the caller with an error status indicating more space is needed. The critical defect occurs because the internal flag or pointer tracking this pending character is not cleared upon returning the E2BIG error. Consequently, when the calling application retries the conversion operation by providing a larger buffer or simply re-invoking the function as part of its retry logic, the converter does not process any new input bytes from the source stream. Instead, it immediately emits the previously stored pending code point again and returns success without advancing the input pointer.
This behavior creates an infinite loop condition for applications that implement standard error handling patterns involving retries on E2BIG errors. Since the converter never consumes further input data while repeatedly emitting the same pending character, any application relying on this conversion process will become unresponsive or hung indefinitely. This represents a classic denial of service vulnerability where resource exhaustion is achieved through CPU cycles consumed in an infinite loop rather than memory allocation failures. The attack requires specific conditions to be met: the attacker must control the input data being converted, and the target application must use an output buffer size that forces the splitting of multi-code point sequences during conversion. While this affects a wide range of glibc versions, the practical impact is somewhat mitigated by the fact that SHIFT_JISX0213 is not commonly used in modern software ecosystems compared to UTF-8 or standard Shift JIS encodings.
From a classification perspective, this vulnerability aligns with CWE-674, which describes uncontrolled recursion or infinite loops resulting from improper error handling logic. The failure to manage state correctly after an incomplete operation leads directly to the denial of service condition. In terms of adversarial tactics, this flaw can be leveraged within the ATT&CK framework under techniques related to Resource Hijacking, specifically causing a Denial of Service through application hang or infinite loop exploitation. Attackers could potentially use crafted input files or network packets containing specific SHIFT_JISX0213 sequences to trigger this state in any service that processes text conversion using affected glibc versions.
Mitigation strategies primarily involve updating the GNU C Library to a patched version where the internal state is correctly cleared after returning E2BIG for partial conversions of multi-code point sequences. For applications unable to update immediately, developers should implement custom error handling logic that detects this specific pattern and breaks out of retry loops if no input progress is detected over multiple iterations. Additionally, validating or sanitizing input character sets before conversion can reduce the attack surface by preventing SHIFT_JISX0213 data from reaching vulnerable code paths entirely. It is also worth noting that a similar defect exists in the EUC_JISX0213 converter and is tracked separately as CVE-2026-80489, suggesting that broader review of character conversion state management may be necessary to prevent analogous issues in other encoding handlers within the library.