CVE-2026-4046CWE-617

iconv crash due to assertion failure with untrusted input

High · published March 30, 2026

CVSS v3.1
7.5
EPSS
1%
Percentile
51.1
In the wild
Unconfirmed
What it is

The iconv() function in the GNU C Library versions 2.43 and earlier may crash due to an assertion failure when converting inputs from the IBM1390 or IBM1399 character sets, which may be used to remotely crash an application.

This vulnerability can be trivially mitigated by removing the IBM1390 and IBM1399 character sets from systems that do not need them.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00662 · 51.1th percentile
Weakness
CWE-617 · Reachable Assertion
Published
2026-03-30T17:16Z
EPSS history
Timeline
  • 30 MAR 17:16Z
    iconv crash due to assertion failure with untrusted input
    cvelistv5