Log in Start free

Vulnerability · Published Apr 10, 2026 · Assigned by VulDB

CVE-2026-6042musl libc GB18030 4-byte Decoder iconv.c iconv algorithmic complexity

Low 3.3

In plain English

A low-severity security flaw in libc from musl. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)3.3Low
Exploit odds (30 days)0.2%top 85.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Public PoC

Official description

A security flaw has been discovered in musl libc up to 1.2.6. Affected is the function iconv of the file src/locale/iconv.c of the component GB18030 4-byte Decoder. Performing a manipulation results in inefficient algorithmic complexity. The attack must be initiated from a local position. To fix this issue, it is recommended to deploy a patch.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.20musl1.2.5-r2ALPINE-CVE-2026-6042
Alpine:v3.21musl1.2.5-r10ALPINE-CVE-2026-6042
Alpine:v3.22musl1.2.5-r11ALPINE-CVE-2026-6042
Alpine:v3.23musl1.2.5-r22ALPINE-CVE-2026-6042
Alpine:v3.24musl1.2.6-r1ALPINE-CVE-2026-6042
Debian:12muslno fix listedDEBIAN-CVE-2026-6042
Debian:13musl1.2.5-3.1~deb13u1DEBIAN-CVE-2026-6042
Debian:14musl1.2.5-3.1DEBIAN-CVE-2026-6042
Ubuntu:22.04:LTSmuslno fix listedUBUNTU-CVE-2026-6042
Ubuntu:24.04:LTSmuslno fix listedUBUNTU-CVE-2026-6042
Ubuntu:25.10muslno fix listedUBUNTU-CVE-2026-6042
Ubuntu:26.04:LTSmuslno fix listedUBUNTU-CVE-2026-6042
Ubuntu:26.10muslno fix listedUBUNTU-CVE-2026-6042

Affected products (as reported)

VendorProductVersions
musl libc 1.2.01.2.11.2.21.2.31.2.41.2.51.2.6

Weakness: CWE-407, CWE-404 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:X/RL:O/RC:C

References