Description

Converting crafted EUC_JISX0213 input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.3 to 2.44 may result in the converter making no progress, causing the calling application to hang. Some EUC_JISX0213 sequences decode to two code points. If the output buffer has room for only the first one, the converter stores the second in the conversion state and returns E2BIG, but it never clears that pending character after emitting it on the next call. The converter then keeps emitting the pending character without consuming further input, so an application that retries the conversion loops forever. The input must be attacker controlled and the application must convert it with an output buffer small enough to split the two code points. Only the EUC_JISX0213 character set is affected, which is not commonly used. The related defect in SHIFT_JISX0213 converter is tracked separately as CVE-2026-77117.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.9",
  "pubDate": "2026-09-15T11:17:12.193Z",
  "pubdate": "2026-09-15T11:17:12.193Z",
  "executiveSummary": "A denial-of-service vulnerability exists in the GNU C Library (glibc) within the EUC_JISX0213 character set conversion implementation.\nThe flaw occurs during multi-byte character decoding when the output buffer size is constrained, leading to an infinite loop in the conversion routine.\nAffected versions include glibc 2.3 through 2.44.\nThe vulnerability is triggered when an application attempts to convert attacker-controlled input using a small output buffer, causing the converter to repeatedly emit a pending character without consuming additional input.\nSuccessful exploitation results in an application hang or infinite resource consumption, effectively denying service.\nThe impact is limited to the conversion process of the EUC_JISX0213 character set, which is historically rare in common web or application traffic.\nExploitation requires the attacker to control the input stream and force the application to perform character conversion with specific buffer boundary conditions.",
  "technicalDetails": "The root cause of this vulnerability lies in the state management logic within the glibc EUC_JISX0213 conversion module. Certain sequences in the EUC_JISX0213 encoding are designed to map to two distinct Unicode code points. When the conversion engine processes such a sequence and determines that the provided output buffer has sufficient space for only the first code point, it is designed to store the remaining (second) code point in the internal conversion state object and return an E2BIG error code, signaling that the output buffer is insufficient.\nThe flaw manifests during subsequent calls to the converter. When the application retries the conversion process—a standard behavior for robust applications handling partial output—the converter fails to clear the pending character state after emitting it. Consequently, the internal state machine enters a cycle where it repeatedly emits the same pending character into the output buffer without advancing the input pointer. This behavior consumes CPU resources indefinitely and prevents the conversion of further input, resulting in a hang.\nThe attack flow requires an attacker to provide a malicious input byte sequence corresponding to the specific multi-code-point EUC_JISX0213 characters. Furthermore, the attacker must be able to influence the application's buffer allocation strategy, ensuring the output buffer is sized exactly to induce a split between the two code points. Once the converter enters the error state and the application attempts a resume, the infinite loop is triggered.\nThis vulnerability is localized to the EUC_JISX0213 converter component. It does not require special authentication or elevated privileges, as the impact is realized through standard application-level processing of user-supplied data. The network exposure is determined by the exposure of the application utilizing glibc conversion functions to untrusted input. While the vulnerability is specifically identified in versions 2.3 through 2.44, the specialized nature of the EUC_JISX0213 encoding reduces the global attack surface. This issue is distinct from the related vulnerability in the SHIFT_JISX0213 converter, identified as CVE-2026-77117."
}