CVE-2026-58081

Several encoding modules, including HZ, UTF-7, VIQR, and ZW, did not properly check the size of the caller-supplied output buffer before writing converted characters. An application that uses iconv(3) to convert untrusted input to or from one of the affected encodings may be vulnerable to buffer overflows if it uses one of the affected encoding modules.

CVSS 3.1

9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.5% chance of exploitation in the next 30 days; higher than 43% of CVEs (scores of 2026-10-26)

CWE

CWE-122

Published

2026-08-19

Modified

2026-10-27

Record from

the NVD, synced 2026-10-27

Affected

• freebsd:freebsd

References

• https://security.freebsd.org/advisories/FreeBSD-SA-26:49.iconv.asc

Check your stackJSON