Description

Converting crafted SHIFT_JISX0213 input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.3 to 2.44 may result in the converter making no progress, causing the calling application to hang. Some SHIFT_JISX0213 sequences decode to two code points. If the output buffer has room for only the first one, the converter stores the second in the conversion state and returns E2BIG, but it never clears that pending character after emitting it on the next call. The converter then keeps emitting the pending character without consuming further input, so an application that retries the conversion loops forever. The input must be attacker controlled and the application must convert it with an output buffer small enough to split the two code points. Only the SHIFT_JISX0213 character set is affected, which is not commonly used. The related defect in the EUC_JISX0213 converter is tracked separately as CVE-2026-80489.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.9",
  "pubDate": "2026-09-15T11:17:12.063Z",
  "pubdate": "2026-09-15T11:17:12.063Z",
  "executiveSummary": "A denial-of-service vulnerability exists in the GNU C Library (glibc) versions 2.3 through 2.44 within the SHIFT_JISX0213 character set converter.\nThe vulnerability occurs during the multi-byte to wide-character conversion process when specific input sequences are paired with constrained output buffer sizes.\nThe flaw allows an attacker to trigger an infinite loop in the calling application by providing crafted input that forces the converter into a state where it repeatedly attempts to process a pending character without consuming new input.\nThis impacts any application utilizing the iconv interface to convert SHIFT_JISX0213 encoded data where the application logic handles E2BIG errors by retrying the conversion.\nWhile SHIFT_JISX0213 is not a ubiquitous encoding, the impact on availability is critical for services that process user-supplied character data, such as web servers, mail filters, or data parsers.\nExploitation requires the attacker to control the input stream and force the output buffer to be small enough to split a sequence that translates into two code points.",
  "technicalDetails": "The root cause of this vulnerability lies in an improper state management implementation within the SHIFT_JISX0213 conversion module of glibc. Certain SHIFT_JISX0213 sequences are designed to decode into two distinct code points. When the glibc converter processes such a sequence and discovers that the provided output buffer has space for only the first of the two code points, it correctly identifies that it cannot complete the conversion and returns the E2BIG error code.\nHowever, the converter state machine incorrectly persists the second, 'pending' code point without clearing it after the first code point is successfully emitted during subsequent calls. Because the conversion state is not reset or updated to reflect the successful output of the first character, the internal state machine remains locked in a loop.\nWhen an application follows standard iconv patterns—treating E2BIG as a signal to retry the conversion after clearing or enlarging the output buffer—the converter re-enters the same internal state. Instead of proceeding to the next byte in the input stream, the converter attempts to emit the identical pending character again without consuming any additional input. This behavior causes the application to hang in an infinite loop, consuming CPU resources indefinitely.\nThe attack flow requires an adversary to submit a specially crafted SHIFT_JISX0213 byte sequence. The attacker must ensure that the targeted application performs the conversion in a context where the output buffer size is restricted, specifically triggering the condition where the conversion of a two-code-point sequence is interrupted after the first segment. The vulnerability is strictly limited to the SHIFT_JISX0213 converter; however, it shares a conceptual similarity with the defect tracked in CVE-2026-80489 regarding the EUC_JISX0213 converter.\nThis vulnerability does not require authentication or elevated privileges, as it targets the inherent data processing logic of the library. It is network-exploitable if the application exposes an interface that accepts user-supplied SHIFT_JISX0213 strings for processing. The post-exploitation impact is a localized or systemic denial of service, as the affected process will experience 100% CPU utilization, effectively stalling the application's event loop or worker threads."
}