CVE-2026-4046: iconv crash due to assertion failure with untrusted input

Description

The iconv() function in the GNU C Library versions 2.43 and earlier may crash due to an assertion failure when converting inputs from the IBM1390 or IBM1399 character sets, which may be used to remotely crash an application. This vulnerability can be trivially mitigated by removing the IBM1390 and IBM1399 character sets from systems that do not need them.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack vector

Network

Complexity

Low

Privileges

None

User interaction

None

Confidentiality

None

Integrity

None

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)0.4% · higher than 33% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

GL

glibc · The GNU C Library

2.3.3 through 2.43 · source: vendor, NVD

SS

SIMATIC S7-1500 CPU 1518-4 PN/DP MFP · Siemens

V3.1.5 before V3.1.6; V3.1.5 before V3.1.6 · source: CISA

SS

SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP · Siemens

V3.1.5 before V3.1.6; V3.1.5 before V3.1.6 · source: CISA

SS

SIPLUS S7-1500 CPU 1518-4 PN/DP MFP · Siemens

V3.1.5 before V3.1.6 · source: CISA