CVE-2025-26519

What it actually does

Out-of-bounds write during iconv conversion of untrusted EUC-KR input to UTF-8 in musl libc versions 0.9.13 to 1.2.5.

Why it matters to the business

Applications on Alpine Linux and other musl-based systems that process untrusted text encodings face risk of crashes or remote code execution, potentially disrupting services or enabling compromise across dependent packages.

How an attack unfolds

An attacker supplies crafted EUC-KR encoded text to trigger iconv conversion in a vulnerable musl libc instance, causing memory corruption that can be leveraged for code execution.

How to fix it

Upgrade musl libc to version 1.2.6 or later, or apply the fix from commit c47ad25ea3b484e10326f933e927c0bc8cded3da; update affected Alpine packages to versions containing the patched musl.

How to confirm the fix worked

Confirm musl version is at least 1.2.6; test iconv conversion with boundary-case EUC-KR inputs to ensure no crash or corruption occurs.

Typical attack path

1. Locate applications or services on musl-based systems that invoke iconv on untrusted EUC-KR data
2. Craft malicious EUC-KR input that triggers the out-of-bounds write during conversion
3. Deliver input to the target conversion routine
4. Achieve memory corruption and attempt to gain control of execution flow

How to detect it

Review application logs and crash reports for iconv-related failures involving EUC-KR input; inspect process memory dumps for signs of buffer overruns during character conversion.

What your security team should do

• Immediately update musl libc across all affected systems to the fixed commit or 1.2.6
• Inventory applications that use iconv with external input and prioritize patching those handling untrusted data
• Monitor upstream Alpine package updates for musl fixes and deploy via standard package management