DEBIAN-CVE-2026-4046
The iconv() function in the GNU C Library versions 2.43 and earlier may crash due to an assertion failure when converting inputs from the IBM1390 or IBM1399 character sets, which may be used to remotely crash an application. This vulnerability can be trivially mitigated by removing the IBM1390 and IBM1399 character sets from systems that do not need them.
DEBIAN-CVE-2026-4046
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:DEBIAN-CVE-2026-4046
glibc
Source reference: /affected/0/package/name
- Affected versions
- 2.36-9
Source reference:
/affected/0/versions2.36-9+deb12u1Source reference:
/affected/0/versions2.36-9+deb12u10Source reference:
/affected/0/versions2.36-9+deb12u11Source reference:
/affected/0/versions2.36-9+deb12u12Source reference:
/affected/0/versions2.36-9+deb12u13Source reference:
/affected/0/versions2.36-9+deb12u2Source reference:
/affected/0/versions2.36-9+deb12u3Source reference:
/affected/0/versions2.36-9+deb12u4Source reference:
/affected/0/versions2.36-9+deb12u5Source reference:
/affected/0/versions2.36-9+deb12u6Source reference:
/affected/0/versions2.36-9+deb12u7Source reference:
/affected/0/versions2.36-9+deb12u8Source reference:
/affected/0/versions2.36-9+deb12u9Source reference:
/affected/0/versions - Fixed versions
- 2.36-9+deb12u14
Source reference:
/affected/0/ranges - Prerequisites
- Not stated in this record
glibc
Source reference: /affected/1/package/name
- Affected versions
- 2.41-12
Source reference:
/affected/1/versions2.41-12+deb13u1Source reference:
/affected/1/versions2.41-12+deb13u2Source reference:
/affected/1/versions - Fixed versions
- 2.41-12+deb13u3
Source reference:
/affected/1/ranges - Prerequisites
- Not stated in this record
glibc
Source reference: /affected/2/package/name
- Affected versions
- 2.41-12
Source reference:
/affected/2/versions2.41-13~hurd.0Source reference:
/affected/2/versions2.41-13~hurd.1Source reference:
/affected/2/versions2.42-1Source reference:
/affected/2/versions2.42-10Source reference:
/affected/2/versions2.42-11Source reference:
/affected/2/versions2.42-12Source reference:
/affected/2/versions2.42-12~hurd.1Source reference:
/affected/2/versions2.42-13Source reference:
/affected/2/versions2.42-14Source reference:
/affected/2/versions2.42-14~hurd.1Source reference:
/affected/2/versions2.42-15~hurd.1Source reference:
/affected/2/versions2.42-2Source reference:
/affected/2/versions2.42-3Source reference:
/affected/2/versions2.42-4Source reference:
/affected/2/versions2.42-5Source reference:
/affected/2/versions2.42-6Source reference:
/affected/2/versions2.42-7Source reference:
/affected/2/versions2.42-8Source reference:
/affected/2/versions2.42-8~hurd.1Source reference:
/affected/2/versions2.42-8~hurd.2Source reference:
/affected/2/versions2.42-9Source reference:
/affected/2/versions - Fixed versions
- 2.42-15
Source reference:
/affected/2/ranges - Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.36-9+deb12u14"
}
]
}
],
"package": {
"name": "glibc",
"purl": "pkg:deb/debian/glibc?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"versions": [
"2.36-9",
"2.36-9+deb12u1",
"2.36-9+deb12u10",
"2.36-9+deb12u11",
"2.36-9+deb12u12",
"2.36-9+deb12u13",
"2.36-9+deb12u2",
"2.36-9+deb12u3",
"2.36-9+deb12u4",
"2.36-9+deb12u5",
"2.36-9+deb12u6",
"2.36-9+deb12u7",
"2.36-9+deb12u8",
"2.36-9+deb12u9"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-4046.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.41-12+deb13u3"
}
]
}
],
"package": {
"name": "glibc",
"purl": "pkg:deb/debian/glibc?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"versions": [
"2.41-12",
"2.41-12+deb13u1",
"2.41-12+deb13u2"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-4046.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.42-15"
}
]
}
],
"package": {
"name": "glibc",
"purl": "pkg:deb/debian/glibc?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"versions": [
"2.41-12",
"2.41-13~hurd.0",
"2.41-13~hurd.1",
"2.42-1",
"2.42-10",
"2.42-11",
"2.42-12",
"2.42-12~hurd.1",
"2.42-13",
"2.42-14",
"2.42-14~hurd.1",
"2.42-15~hurd.1",
"2.42-2",
"2.42-3",
"2.42-4",
"2.42-5",
"2.42-6",
"2.42-7",
"2.42-8",
"2.42-8~hurd.1",
"2.42-8~hurd.2",
"2.42-9"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-4046.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #56088 · Revision 1
- Added to Heist Feed
- Publisher date