CVE-2025-26519 Details
Description
musl libc 0.9.13 through 1.2.5 before 1.2.6 has an out-of-bounds write vulnerability when an attacker can trigger iconv conversion of untrusted EUC-KR text to UTF-8.
A vulnerability exists in musl libc versions 0.9.13 through 1.2.5 prior to 1.2.6, allowing out-of-bounds memory writes. This issue arises when an application uses the iconv function to convert untrusted EUC-KR text to UTF-8, particularly when the input charset is controlled by the user. The vulnerability is triggered by incorrect validation of input bytes in the EUC-KR decoder, combined with the UTF-8 encoder's assumption that all input characters are valid Unicode Scalar Values.
Users should apply the available patches to fix the vulnerability and can obtain updated musl libc packages through their distribution's update channels. For static-linked binaries that cannot be relinked, the vulnerability can be mitigated by hex-editing the binary to disable EUC-KR support, making the vulnerable code unreachable.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Feb 14, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2025/02/13/2 | CVE | Mailing ListMitigationThird Party Advisory |
| http://www.openwall.com/lists/oss-security/2025/02/13/3 | CVE | Mailing ListThird Party Advisory |
| http://www.openwall.com/lists/oss-security/2025/02/13/4 | CVE | Mailing ListMitigationThird Party Advisory |
| http://www.openwall.com/lists/oss-security/2025/02/13/5 | CVE | Mailing ListMitigationThird Party Advisory |
| http://www.openwall.com/lists/oss-security/2025/02/14/5 | CVE | Mailing ListThird Party Advisory |
| http://www.openwall.com/lists/oss-security/2025/02/14/6 | CVE | Mailing ListThird Party Advisory |
| https://git.musl-libc.org/cgit/musl/commit/?id=c47ad25ea3b484e10326f933e927c0bc8cded3da | [email protected] | Patch |
| https://git.musl-libc.org/cgit/musl/commit/?id=e5adcd97b5196e29991b524237381a0202a60659 | [email protected] | Patch |
| https://www.openwall.com/lists/oss-security/2025/02/13/2 | [email protected] | Mailing ListMitigationThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-787 | Out-of-bounds Write | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| musl-libc musl | >= 0.9.13, < 1.2.6 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Dec 10, 2025 | Initial Analysis | [email protected] |
| Feb 14, 2025 | CVE Modified | CVE |
| Feb 14, 2025 | New CVE Received | [email protected] |
| Feb 14, 2025 | CVE Modified | CVE |