Logo
›
›vulnerability›CVE-2025-26519
Name
CVE-2025-26519
Source
NVD ( link)Debian ( link)
Description
musl libc 0.9.13 through 1.2.5 before 1.2.6 has an out-of-bounds write vulnerability when an attacker can trigger iconv conversion of untrusted EUC-KR text to UTF-8.
CWEs
CWE-787
Published Date
Updated Date
Workaround
-
Advisories
https://git.musl-libc.org/cgit/musl/commit/?id=c47ad25ea3b484e10326f933e927c0bc8cded3daPatch
https://git.musl-libc.org/cgit/musl/commit/?id=e5adcd97b5196e29991b524237381a0202a60659Patch
https://www.openwall.com/lists/oss-security/2025/02/13/2Mailing List
http://www.openwall.com/lists/oss-security/2025/02/13/2Mailing List
http://www.openwall.com/lists/oss-security/2025/02/13/3Mailing List
http://www.openwall.com/lists/oss-security/2025/02/13/4Mailing List
http://www.openwall.com/lists/oss-security/2025/02/13/5Mailing List
http://www.openwall.com/lists/oss-security/2025/02/14/5Mailing List
http://www.openwall.com/lists/oss-security/2025/02/14/6Mailing List

Analysis#

Affected Component
Analysis
musl
Patched

Vulnerability Ratings#

8.1
CVSSv31
7
CVSSv31
NaN
other

Others affected components#

Name
Project
Project Version
Version
Status
musl
buildroot
2025.02.x
1.2.6
Not Affected
musl
buildroot
master
1.2.6
Not Affected
musl
yocto
master
1.2.6+git
Not Affected
musl
yocto
scarthgap
1.2.4+git
Patched

Resolved with patches#

musl (yocto:kirkstone)

#
Title
Author
Resolve
1
iconv: fix erroneous input validation in EUC-KR decoder
Rich Felker <dalias@aerifal.cx>
CVE-2025-26519
2
iconv: harden UTF-8 output code path against input decoder
Rich Felker <dalias@aerifal.cx>
CVE-2025-26519

musl (yocto:scarthgap)

#
Title
Author
Resolve
1
iconv: fix erroneous input validation in EUC-KR decoder
Rich Felker <dalias@aerifal.cx>
CVE-2025-26519
2
iconv: harden UTF-8 output code path against input decoder
Rich Felker <dalias@aerifal.cx>
CVE-2025-26519