FreeBSD CVE-2026-58081

Exploitation requires that a target application on an affected FreeBSD release actually calls iconv(3) to convert attacker-influenced data using one of exactly four encoding modules - HZ, UTF-7, VIQR, or ZW; conversions using any other encoding are not affected. This is the concrete precondition: the vulnerable code path is only reached when one of these charsets is selected (often driven by attacker-supplied charset labels in protocols like email/IMAP that permit UTF-7). Limiting factors: no vulnerability exists if the application never uses these encodings or never exposes the converter to untrusted input; there is no authentication or user-interaction requirement in the flaw itself (PR:N/UI:N per CVSS), but the network reachability of the bug is entirely mediated by the host application rather than by FreeBSD directly.

Signals conflict and must be weighed carefully. CVSS is 9.8 (AV:N/AC:L/PR:N/UI:N, full C/I/A impact), which treats the flaw as trivially remote-exploitable, but that score assumes an application actually feeds attacker-controlled data through one of four uncommon encodings - a significant real-world precondition not captured by the raw vector. EPSS is only 0.21% (12th percentile), and the CVE is NOT in CISA KEV, with no public exploit identified, indicating no observed or predicted mass exploitation. The practical priority therefore hinges on whether deployed applications invoke iconv with HZ/UTF-7/VIQR/ZW on untrusted input; for the majority of systems that do not, real risk is far below the 9.8 headline, while for the minority that do (e.g. mail or internationalization pipelines using UTF-7), memory-corruption-to-RCE is plausible. This is best treated as a high-severity latent flaw warranting prompt patching but not an emergency mass-exploitation event based on current signals.

An application on an unpatched FreeBSD host (for example an IMAP server, mail filter, or web app) accepts remote input tagged with a UTF-7 or HZ charset and passes it to iconv(3) for conversion. A crafted input sequence expands to more output than the caller's buffer can hold, overflowing the heap and corrupting adjacent allocations, which an attacker can leverage toward code execution in the service's context. No public exploit is currently known, so exploitation would require original development against the target's specific iconv usage.