CVE-2025-26519

low-risk

Published 2025-02-14

musl libc 0.9.13 through 1.2.5 before 1.2.6 has an out-of-bounds write vulnerability when an attacker can trigger iconv conversion of untrusted EUC-KR text to UTF-8.

Do I need to act?

0.03% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 8.1/10 High

LOCAL / HIGH complexity

Affected Products (1)

Musl

Affected Vendors

Musl-Libc

References (9)

Patch https://git.musl-libc.org/cgit/musl/commit/?id=c47ad25ea3b484e10326f933e927c0bc8...

Patch https://git.musl-libc.org/cgit/musl/commit/?id=e5adcd97b5196e29991b524237381a020...

Mailing List https://www.openwall.com/lists/oss-security/2025/02/13/2

Mailing List http://www.openwall.com/lists/oss-security/2025/02/13/2

Mailing List http://www.openwall.com/lists/oss-security/2025/02/13/3

Mailing List http://www.openwall.com/lists/oss-security/2025/02/13/4

Mailing List http://www.openwall.com/lists/oss-security/2025/02/13/5

Mailing List http://www.openwall.com/lists/oss-security/2025/02/14/5

Mailing List http://www.openwall.com/lists/oss-security/2025/02/14/6

/ 100

low-risk

Severity 21/34 · High

Exploitability 0/34 · Minimal

Exposure 5/34 · Minimal