CVE-2025-26519: [musl] CVE-2025-26519: musl libc: input-controlled out-of-bounds write primitive in iconv()
musl libc 0.9.13 through 1.2.5 before 1.2.6 has an out-of-bounds write vulnerability when an attacker can trigger iconv conversion of untrusted EUC-KR text to UTF-8.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
musl libcto a version that resolves this vulnerability.Fixed in 1.2.6 - Compensating control
If iconv is used to convert untrusted EUC-KR text to UTF-8, prevent attackers from triggering those conversions (e.g., avoid converting untrusted EUC-KR input with iconv or restrict access to the code path that performs the iconv conversion).
Event History
Frequently Asked Questions
What is the severity of CVE-2025-26519?
CVE-2025-26519 has been classified as a critical vulnerability due to its potential for causing significant security risks.
How do I fix CVE-2025-26519?
To fix CVE-2025-26519, upgrade musl libc to version 1.2.6 or later.
What software is affected by CVE-2025-26519?
CVE-2025-26519 affects musl libc versions from 0.9.13 to 1.2.5.
What type of vulnerability is CVE-2025-26519?
CVE-2025-26519 is an out-of-bounds write vulnerability triggered during iconv conversion of EUC-KR text.
Can CVE-2025-26519 be exploited remotely?
Yes, CVE-2025-26519 can be exploited remotely if an attacker can supply untrusted EUC-KR input.