CVE-2026-4046 describes a high-severity assertion failure in the iconv() function of GNU C Library versions 2.43 and earlier, which can lead to an application crash when converting inputs from the IBM1390 or IBM1399 character sets. Rated 7.5 CVSS (High), this vulnerability allows an unauthenticated attacker to remotely trigger a denial-of-service condition with low attack complexity, impacting system availability. There is currently no evidence of active exploitation, nor are public exploit modules available, though it has garnered some community discussion. A straightforward mitigation involves removing the IBM1390 and IBM1399 character sets from systems where they are not required.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 2.43CPE matchmatch criteria | cpe:2.3:a:gnu:glibc:*:*:*:*:*:*:*:* | ||
>= 2.3.3, <= 2.43CPE match | cpe:2.3:a:gnu:glibc:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.