CVE-2026-58081

Several encoding modules, including HZ, UTF-7, VIQR, and ZW, did not properly check the size of the caller-supplied output buffer before writing converted characters. An application that uses iconv(3) to convert untrusted input to or from one of the affected encodings may be vulnerable to buffer overflows if it uses one of the affected encoding modules.

Score

CVSS 3.1 9.8 Critical

Status

Analyzed - secteam@freebsd.org

Published

2026-08-19

Last modified

2026-10-27

Weaknesses

CWE-122

Affected products

• Freebsd (Freebsd)

References

• https://security.freebsd.org/advisories/FreeBSD-SA-26:49.iconv.asc