CVE-2026-122054 · Infrastructure
NO FIX YET
Converting specially crafted BIG-HKSCS text to UCS-4 or the internal wide character encoding with iconv in glibc 2.18 through 2.31 can make the converter stop making progress. The calling application then hangs.
first public Nov 4, 2026 · 1 source
Is this in your stack? Find out in 2 minutes.
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Systems running glibc 2.18 through 2.31 that pass untrusted BIG-HKSCS text through iconv into UCS-4 or wchar conversion. Systems on newer glibc or that never convert BIG-HKSCS input from outside can skip it. The sources do not describe a fixed version.
Not affected if default-config, no-untrusted-input
Who cares glibc, iconv, linux
ldd --version, and see whether it falls in the affected range 2.18 through 2.31.No fix yet, per the sources.
Converting crafted BIG-HKSCS input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.18 through 2.31 may result in the converter making no progress, causing the calling application to hang.
This page as .md · .json · in your agent: get_signal("CVE-2026-122054") · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.