GNU libidn EUVD-2026-38523

The target environment must have an application linked against GNU libidn (not libidn2) in a version prior to 1.44 that passes attacker-influenced internationalized domain name strings to the ToUnicode API. The specific internal function idna_to_unicode_internal must be reached via the ToUnicode call path with a malformed input that triggers the out-of-bounds read - the AC:H rating indicates this is not trivially achieved with arbitrary input. Exploitation is limited by the requirement for the attacker to control or influence the hostname/domain string processed by the vulnerable API call, and by the need to craft input that specifically exercises the uninitialized memory read condition. Deployments using libidn2 exclusively are not affected, as the vulnerable code is absent from that library.

The NVD-assigned CVSS 3.1 score of 4.0 with vector AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L reflects a constrained risk profile, but several metric choices warrant scrutiny. The local attack vector (AV:L) is atypical for a string-processing library whose ToUnicode APIs are commonly invoked by network-facing applications (DNS resolvers, mail transfer agents, web browsers) that process externally-supplied hostnames - the effective attack surface may be broader than AV:L implies, depending on the consuming application architecture. The high attack complexity (AC:H) is plausible given the need to craft input that specifically triggers the uninitialized memory read path. The C:N assignment is notable: out-of-bounds reads of uninitialized memory frequently expose sensitive in-process memory contents, creating a potential confidentiality impact that appears underweighted here; this discrepancy should be verified against the vendor's analysis. No EPSS score data was provided, preventing probabilistic exploitation modeling. The vulnerability is not listed in the CISA KEV catalog and no proof-of-concept exploit code has been identified, indicating low immediate exploitation pressure. Real-world priority is moderate for environments where libidn-linked applications process untrusted internationalized hostnames from external sources.

An attacker able to influence the internationalized domain name strings processed by an application using GNU libidn - for example, by sending a crafted DNS response, email header, or URI containing a malformed Punycode label - could cause idna_to_unicode_internal to read beyond an allocated buffer into uninitialized memory. This could result in application instability, a crash (availability impact), or exposure of in-process memory contents. No public proof-of-concept has been identified, and the AC:H rating indicates that reliably triggering the specific vulnerable code path requires precision in input construction.