FreeBSD CVE-2026-58082

Exploitation requires an application on an affected FreeBSD release that calls iconv(3) to convert attacker-controlled input to or from one of the affected ISO-2022 encoding variants (the ones that can emit up to 10 bytes per character); the overflow only triggers on that specific encoding path. Limiting factors: the target application must actually invoke iconv on untrusted data with an affected charset (many applications default to UTF-8 and never touch ISO-2022), and the write is bounded to four bytes past the buffer, which limits reliable code execution relative to the 9.8 base score. No authentication is required at the library level (CVSS PR:N), but reachability depends entirely on the calling application's exposure and configuration rather than a network service listening by default.

The published CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, base 9.8) treats this as trivially remote and unauthenticated, but that scoring reflects the worst case for an application that feeds attacker-controlled data straight through iconv into an affected ISO-2022 encoding - it is a library primitive, not a directly network-listening service, so real exposure is entirely a function of how a given application calls iconv. The overflow is bounded to four bytes, which meaningfully constrains reliable arbitrary code execution and makes a crash/denial-of-service or limited adjacent-stack corruption the more probable outcome, so I assess exploitability as harder than AC:L implies. Corroborating signals point to lower urgency than the 9.8 suggests: EPSS is 0.21% (12th percentile), the CVE is not in CISA KEV, and no proof-of-concept is referenced. That said, iconv sits under many mail, web, and text-processing stacks, so an operator running FreeBSD-based services that transcode untrusted user input - even a mid-sized shop with only a handful of internet-facing FreeBSD hosts should treat patching as routine-but-prompt - has a plausible DoS exposure. Net: a genuinely high-severity memory-safety bug worth patching in the normal cycle, but the combination of a 4-byte bound, low EPSS, and no known exploitation argues against emergency out-of-band response for most environments.

An attacker submits crafted text - for example an email header, HTTP body, or filename declared in an affected ISO-2022 charset - to a FreeBSD-hosted service that calls iconv(3) to transcode it. The conversion emits a longer-than-expected multibyte sequence, writing up to four bytes past the fixed stack buffer, most plausibly crashing the worker process (DoS) and, depending on stack layout and compiler mitigations, potentially corrupting adjacent stack data. No public exploit is currently known.