CVE-2026-58081 — Heap based buffer overflow in iconv(3)

Description (CNA)

Several encoding modules, including HZ, UTF-7, VIQR, and ZW, did not properly check the size of the caller-supplied output buffer before writing converted characters. An application that uses iconv(3) to convert untrusted input to or from one of the affected encodings may be vulnerable to buffer overflows if it uses one of the affected encoding modules.

Affected (CNA)

Vendor / product	Versions
FreeBSD / FreeBSD	affected 15.1-RELEASE before p1; affected 15.0-RELEASE before p11; affected 14.4-RELEASE before p7; affected 14.3-RELEASE before p16

CWE

CWE-122

References

https://security.freebsd.org/advisories/FreeBSD-SA-26:49.iconv.asc

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.