CVE-2026-4046

HighCVSS 7.5/10Last modified Jul 14, 2026

Description

The iconv() function in the GNU C Library versions 2.43 and earlier may crash due to an assertion failure when converting inputs from the IBM1390 or IBM1399 character sets, which may be used to remotely crash an application.

This vulnerability can be trivially mitigated by removing the IBM1390 and IBM1399 character sets from systems that do not need them.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-617

Affected software

Vendor	Product	Versions
The GNU C Library	glibc	>= 2.3.3, <= 2.43
Siemens	SIMATIC S7-1500 CPU 1518-4 PN/DP MFP	>= V3.1.5, < V3.1.6
Siemens	SIMATIC S7-1500 CPU 1518-4 PN/DP MFP	>= V3.1.5, < V3.1.6
Siemens	SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP	>= V3.1.5, < V3.1.6
Siemens	SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP	>= V3.1.5, < V3.1.6
Siemens	SIPLUS S7-1500 CPU 1518-4 PN/DP MFP	>= V3.1.5, < V3.1.6

References

Timeline

Published: Mar 30, 2026
Last modified: Jul 14, 2026
NVD status: Modified

Related CVEs from 2026

CVE-2026-404606.5When NGINX Plus or NGINX Open Source are configured to use the HTTP/3 QUIC module, an attacker may be able to spoof their source IP address CVE-2026-404617.5Anviz CX2 Lite and CX7 are vulnerable to unauthenticated POST requests that modify debug settings (e.g., enabling SSH), allowing unauthoriz CVE-2026-404626.5Incorrect permission assignment vulnerabilities exist in iControl REST and TMOS shell (tmsh) undisclosed command which may allow an authenti CVE-2026-404637.6WaveSuite is affected by an insufficient role-based access control vulnerability in the CPB Log Files feature. Successful exploitation allow CVE-2026-404645.4NSP is vulnerable to a stored XSS due to insufficient validation or encoding of user-controlled input in a workflow application. An authenti CVE-2026-404655.3NSP is vulnerable to an open redirect due to insufficient server-side validation of the URL (or redirect) parameter.CVE-2026-404668.8Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveM CVE-2026-404677.5Use After Free vulnerability has been found in "io.c" program file of gawk (do_getline_redir() routine). This issue may lead to a crash. It CVE-2026-404689.1Integer overflow vulnerability has been found in "builtin.c" program file of gawk. This issue may lead to memory exhaustion on the hosting o CVE-2026-404699.1Integer overflow vulnerability has been found in "builtin.c" program file of gawk (do_sub() routine). This issue could be used to overwrite CVE-2026-404709.9A critical XSS vulnerability affected hackage-server and hackage.haskell.org. HTML and JavaScript files provided in source packages or via CVE-2026-404719.6hackage-server lacked Cross-Site Request Forgery (CSRF) protection across its endpoints. Scripts on foreign sites could trigger requests to