CVE-2025-26519
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2025-26519
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-26519.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2025-26519
- Downstream
- Published
- 2025-02-14T04:15:09.050Z
- Modified
- 2025-12-12T21:51:11.664664Z
- Severity
-
- 7.0 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- [none]
- Details
-
musl libc 0.9.13 through 1.2.5 before 1.2.6 has an out-of-bounds write vulnerability when an attacker can trigger iconv conversion of untrusted EUC-KR text to UTF-8.
- References
-
- https://www.openwall.com/lists/oss-security/2025/02/13/2
- http://www.openwall.com/lists/oss-security/2025/02/13/2
- http://www.openwall.com/lists/oss-security/2025/02/13/4
- http://www.openwall.com/lists/oss-security/2025/02/13/5
- http://www.openwall.com/lists/oss-security/2025/02/13/3
- http://www.openwall.com/lists/oss-security/2025/02/14/5
- http://www.openwall.com/lists/oss-security/2025/02/14/6
- https://git.musl-libc.org/cgit/musl/commit/?id=c47ad25ea3b484e10326f933e927c0bc8cded3da
- https://git.musl-libc.org/cgit/musl/commit/?id=e5adcd97b5196e29991b524237381a0202a60659
Affected packages
Git / git.musl-libc.org/git/musl
Affected ranges
- Type
- GIT
- Repo
- https://git.musl-libc.org/git/musl
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixedc47ad25ea3b484e10326f933e927c0bc8cded3daFixede5adcd97b5196e29991b524237381a0202a60659
Affected versions
v0.*
v0.5.0
v0.5.9
v0.6.0
v0.7.0
v0.7.1
v0.7.10
v0.7.11
v0.7.12
v0.7.5
v0.7.6
v0.7.7
v0.7.8
v0.7.9
v0.8.0
v0.8.1
v0.8.10
v0.8.2
v0.8.3
v0.8.4
v0.8.5
v0.8.6
v0.8.7
v0.8.8
v0.8.9
v0.9.0
v0.9.1
v0.9.10
v0.9.11
v0.9.12
v0.9.13
v0.9.14
v0.9.15
v0.9.2
v0.9.3
v0.9.4
v0.9.5
v0.9.6
v0.9.7
v0.9.8
v0.9.9
v1.*
v1.0.0
v1.1.0
v1.1.1
v1.1.10
v1.1.11
v1.1.12
v1.1.13
v1.1.14
v1.1.15
v1.1.16
v1.1.17
v1.1.18
v1.1.19
v1.1.2
v1.1.20
v1.1.21
v1.1.22
v1.1.23
v1.1.24
v1.1.3
v1.1.4
v1.1.5
v1.1.6
v1.1.7
v1.1.8
v1.1.9
v1.2.0
v1.2.1
v1.2.2
v1.2.3
v1.2.4
v1.2.5
Database specific
vanir_signatures
[
{
"digest": {
"function_hash": "93419066010476125232935541587925431376",
"length": 11159.0
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1",
"target": {
"file": "src/locale/iconv.c",
"function": "iconv"
},
"id": "CVE-2025-26519-018d6cac",
"source": "https://git.musl-libc.org/git/musl@e5adcd97b5196e29991b524237381a0202a60659"
},
{
"digest": {
"function_hash": "167809337656710166781439122833321772026",
"length": 11167.0
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1",
"target": {
"file": "src/locale/iconv.c",
"function": "iconv"
},
"id": "CVE-2025-26519-4d9c4667",
"source": "https://git.musl-libc.org/git/musl@c47ad25ea3b484e10326f933e927c0bc8cded3da"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"129306248461741217178475625607907061982",
"255163811664769576354929690911416551658",
"197971057117161259549704318582357211451",
"2381129348957302750695086902723883393"
]
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1",
"target": {
"file": "src/locale/iconv.c"
},
"id": "CVE-2025-26519-eaf2b425",
"source": "https://git.musl-libc.org/git/musl@e5adcd97b5196e29991b524237381a0202a60659"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"68640536640438550437011154975415953180",
"255003065411938373494259616672361207301",
"144306552937797799478204467318652076715",
"125054553382242497022687901941500091595"
]
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1",
"target": {
"file": "src/locale/iconv.c"
},
"id": "CVE-2025-26519-fdb73675",
"source": "https://git.musl-libc.org/git/musl@c47ad25ea3b484e10326f933e927c0bc8cded3da"
}
]