Executive brief
A vulnerability in the standard GNU C Library (glibc) can cause applications to crash when processing specifically formatted text. This affects systems using the iconv component to convert text between different character sets, such as IBM1390 or IBM1399. An attacker could exploit this to remotely shut down services or applications, leading to a denial of service.
Technical details
A reachable assertion vulnerability (CWE-617) exists in the glibc iconv() function when handling IBM1390 and IBM1399 character sets. The root cause is an assertion failure in 'skeleton.c' triggered when a 'combined' character (which expands to multiple UCS-4 code points) is processed with an insufficient output buffer, causing a mismatch between the output buffer pointer and the error pointer during a conversion rerun. A remote, unauthenticated attacker can trigger this crash by providing malicious input to any application that performs character set conversion using affected glibc versions. The issue is fixed in glibc version 2.44 and has been backported to stable branches (2.43, 2.42). A workaround involves removing the IBM1390 and IBM1399 gconv modules from the system.
Affected products
- GNU glibc <= 2.43
- Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5
- Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.5
- Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP V3.1.5
Timeline
- 2026-03-12: disclosed: Initial report by Rocket Ma
- 2026-03-30: advisory: GLIBC-SA-2026-0007 published
- 2026-04-16: patched: Fixed in glibc master branch for version 2.44
- 2026-04-19: patched: Backported to glibc 2.43 and 2.42 release branches
References
- https://inbox.sourceware.org/libc-announce/76814edf-cf7f-47ec-979d-2dce0a2c76bf@gotplt.org/T/
- https://sourceware.org/bugzilla/show_bug.cgi?id=33980
- https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0007;hb=HEAD
- https://cert-portal.siemens.com/productcert/html/ssa-082556.html