Log in Start free

Vulnerability · Published Feb 14, 2025 · Assigned by mitre

CVE-2025-26519

High 8.1

In plain English

A high-severity out-of-bounds write in musl from musl-libc. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 29% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.1High
Exploit odds (30 days)0.3%top 71.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

musl libc 0.9.13 through 1.2.5 before 1.2.6 has an out-of-bounds write vulnerability when an attacker can trigger iconv conversion of untrusted EUC-KR text to UTF-8.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.20musl1.2.5-r1ALPINE-CVE-2025-26519
Alpine:v3.21musl1.2.5-r9ALPINE-CVE-2025-26519
Alpine:v3.22musl1.2.5-r10ALPINE-CVE-2025-26519
Alpine:v3.23musl1.2.5-r10ALPINE-CVE-2025-26519
Alpine:v3.24musl1.2.5-r10ALPINE-CVE-2025-26519
Debian:12muslno fix listedDEBIAN-CVE-2025-26519
Debian:13musl1.2.5-2DEBIAN-CVE-2025-26519
Debian:14musl1.2.5-2DEBIAN-CVE-2025-26519
Ubuntu:22.04:LTSmuslno fix listedUBUNTU-CVE-2025-26519
Ubuntu:24.04:LTSmuslno fix listedUBUNTU-CVE-2025-26519
Ubuntu:25.10muslno fix listedUBUNTU-CVE-2025-26519
Ubuntu:26.04:LTSmuslno fix listedUBUNTU-CVE-2025-26519
Ubuntu:26.10muslno fix listedUBUNTU-CVE-2025-26519

Affected products (as reported)

VendorProductVersions
musl-libc musl 0.9.13 – before 1.2.6

Weakness: CWE-787 · Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L

References