Glibc CVE-2026-4046

GNU C Library versions 2.43 and earlier with IBM1390 or IBM1399 character sets enabled. Remote unauthenticated attacker can crash applications using iconv() by providing specially crafted input from these character sets. No user interaction required.

This vulnerability presents moderate-to-high real-world risk despite being a denial-of-service rather than code execution. The CVSS 7.5 score accurately reflects the attack surface: network-accessible (AV:N), low complexity (AC:L), no privileges required (PR:N), and no user interaction (UI:N). The SSVC decision framework reinforces practical exploitability with three critical signals: (1) Exploitation status is 'poc' - proof-of-concept code exists, confirming technical feasibility; (2) Automatable is 'yes' - the attack requires no manual intervention or user interaction, enabling weaponization in automated exploit frameworks; (3) Technical Impact is 'partial' - the outcome is localized availability loss rather than complete system compromise. Crucially, IBM1390 and IBM1399 are niche character sets, limiting exposure compared to high-prevalence encodings. However, the attack vector (network, unauthenticated, no complexity) means any web application, mail server, or content processing pipeline using iconv() without input validation is vulnerable. Organizations running older glibc versions on production systems face real disruption risk. The trivial mitigation (removing unused character sets) and absence of critical infrastructure dependency on these encodings limit severity, but automated attackers could still enumerate vulnerable services.

An attacker sends a crafted HTTP request or email message containing a Content-Type header or inline encoding declaration specifying IBM1390 or IBM1399 charset with carefully malformed input bytes. A vulnerable web application or mail server processes the request through iconv() for character normalization or encoding conversion, triggering the assertion failure and crashing the service process. If the application lacks restart mechanisms or crash detection, repeated requests can sustain availability impact. Alternatively, an attacker probes a content management system, file upload handler, or search indexing service that auto-detects and converts character encodings, injecting malicious IBM1390-encoded payloads to trigger denial of service without requiring authentication or user interaction.