CVE-2026-58081

CriticalCVSS 9.8/10Last modified Aug 31, 2026

Description

Several encoding modules, including HZ, UTF-7, VIQR, and ZW, did not properly check the size of the caller-supplied output buffer before writing converted characters.

An application that uses iconv(3) to convert untrusted input to or from one of the affected encodings may be vulnerable to buffer overflows if it uses one of the affected encoding modules.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-122

Affected software

No affected versions have been published.

Timeline

Published: Aug 19, 2026
Last modified: Aug 31, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-580829.8The ISO-2022 encoding module used a stack buffer sized to MB_LEN_MAX (6 bytes) for intermediate character output. Some ISO-2022 variants ca CVE-2026-580838.4While the kernel was copying knotes during fork, a knote with a timer-based filter could fire and be enqueued on the kqueue's active list be CVE-2026-580845.5To retrieve the previous timer value, the kernel calls realtimer_gettime(), which obtains the current time for the timer's clock. For a tim CVE-2026-580857.5After dispatching a decrypt operation to OCF and receiving the result, the wg(4) driver failed to check whether the MAC verification step su CVE-2026-580868.1As an inadvertent side effect of an unrelated code change, PRIV_KTRACE was always denied to a jailed root user. Tracing configured by a jai CVE-2026-580877.8The GETALL and SETALL commands in semctl(2) recorded the number of semaphores in the target set, dropped the lock protecting the set, alloca CVE-2026-580887.4The ELF core dump code counted the number of dumpable VM map entries, allocated a buffer for the corresponding program headers, then iterate CVE-2026-580897.8When a process calls execve(2) to execute a setuid or setgid image, hwpmc(4) is supposed to detach PMCs owned by unprivileged processes. An CVE-2026-58097.1The wpForo Forum plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to and including 3.0.2. This is due to a two-s CVE-2026-580907.8The SOCK_STREAM receive path in the unix socket implementation failed to fully detach control messages from the socket buffer before process CVE-2026-580917.8The implementation of this ioctl attempts to acquire locks on all channels in a sync group. If locking a channel would block, it releases t CVE-2026-580928.1In FreeBSD 15.0, the kernel structure used to represent user credentials changed: previously the primary group ID was stored in the first el