Log in Start free

Vulnerability · Published Aug 19, 2026 · Assigned by freebsd

CVE-2026-58082Stack based buffer overflow in iconv(3)

Critical 9.8

In plain English

A critical-severity stack buffer overflow in FreeBSD from FreeBSD. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities).

Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)0.5%top 55.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

The ISO-2022 encoding module used a stack buffer sized to MB_LEN_MAX (6 bytes) for intermediate character output. Some ISO-2022 variants can require up to 10 bytes per character, in which case conversions can trigger a stack buffer overflow of up to four bytes. An application that uses iconv(3) to convert untrusted input to or from one of the affected encodings may be vulnerable to buffer overflows if it uses one of the affected encoding modules.

Affected products (as reported)

VendorProductVersions
FreeBSD FreeBSD 15.1-RELEASE – before p115.0-RELEASE – before p1114.4-RELEASE – before p714.3-RELEASE – before p16

Weakness: CWE-121 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References