CVE-2026-122054

MediumCVSS 5.9/10Last modified Nov 4, 2026

Description

Converting crafted BIG-HKSCS input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.18 through 2.31 may result in the converter making no progress, causing the calling application to hang.

Metrics

CVSS 3.1 5.9/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-835

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
The GNU C Library	glibc	>= 2.18, <= 2.31

References

Timeline

Published: Nov 4, 2026
Last modified: Nov 4, 2026
NVD status: Received

Related CVEs from 2026

CVE-2026-1220565.9A flaw was found in OpenSCAP. A heap-based buffer overflow can occur when processing a specially crafted Extensible Configuration Checklist CVE-2026-1220596.4The WP ImageViewer plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'img.alt' parameter in all versions u CVE-2026-122066.3A vulnerability was identified in Grit42 Grit up to 0.11.0. This issue affects the function Grit::Assays::DataTableEntity of the file module CVE-2026-1220605.3The WP Recipe Maker WordPress plugin before 10.9.2 does not check whether the post a recipe is embedded in is password protected before retu CVE-2026-1220615.3The Event Tickets and Registration WordPress plugin before 5.30.3.1 does not correctly check whether an event displays a public attendee lis CVE-2026-1220625.3The Pronamic Pay WordPress plugin before 11.1.0, Pronamic Pay doneren met Mollie WordPress plugin before 1.7.1 do not restrict access to sto CVE-2026-122074.3A security flaw has been discovered in medkey-org medkey up to fc09b7ba9441ff590b72d428d5380834216b09ed. Impacted is the function actionGetP CVE-2026-122085.3A weakness has been identified in jsonata-js jsonata up to 2.2.0. The affected element is the function createFrame of the file src/jsonata.j CVE-2026-1220856.5The Event Tickets Manager for WooCommerce WordPress plugin before 1.6.0 does not perform authorisation or a valid nonce check on its ticket-CVE-2026-1220873.7The Event Tickets and Registration WordPress plugin before 5.30.3.1 does not restrict attendee data to events the requester is allowed to vi CVE-2026-122095.3A security vulnerability has been detected in RubyLouvre avalon up to 2.2.10. The impacted element is an unknown function of the file src/fi CVE-2026-1220957.6AsiaInfo BSS Platform 9.2 before 9.2.38 has a stored cross-site scripting (XSS) vulnerability in the menu icon upload function. An authentic