CVE-2026-122054 PUBLISHED

BIG-HKSCS decoding hang on crafted input

Assigner: glibc
Reserved: 04.11.2026 Published: 04.11.2026 Updated: 04.11.2026

Converting crafted BIG-HKSCS input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.18 through 2.31 may result in the converter making no progress, causing the calling application to hang.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS Score: 5.9

Attack Vector	Network	Scope	Unchanged
Attack Complexity	High	Confidentiality Impact	None
Privileges Required	None	Integrity Impact	None
User Interaction	None	Availability Impact	High

CVSS 3.1

Product Status

Vendor	The GNU C Library
Product	glibc
Versions	Default: unaffected affected from 2.18 to 2.31 (incl.)

Credits

Tom Honermann reporter

References

https://sourceware.org/bugzilla/show_bug.cgi?id=25734
https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0026

Problem Types

CWE-835 Loop with unreachable exit condition ('infinite loop') CWE

Impacts

CAPEC-153 Input Data Manipulation