CVE-2026-4046

What it actually does

GNU glibc versions 2.43 and earlier can hit an assertion failure in iconv() when an application asks glibc to convert data from the IBM1390 or IBM1399 character sets. If a network-facing application accepts attacker-controlled character-set names or encoded input and passes them to iconv(), the process can abort, causing a denial of service. The impact is availability-only: the vulnerability is not described as enabling code execution, privilege escalation, or data disclosure.

Why it matters to the business

An attacker may be able to remotely crash services that process user-supplied text encodings, such as web applications, API gateways, mail-processing services, file import pipelines, identity systems, or middleware using glibc iconv(). This can cause service outages, failed transactions, degraded application availability, and operational disruption. The CVSS availability impact is high, but current exploit telemetry is low: EPSS is 0.00382 with no 30-day increase, no known CISA KEV listing, no ransomware association, and no public exploit maturity reported in the provided data.

How an attack unfolds

An attacker first identifies an application that relies on GNU glibc iconv() for character-set conversion and allows the input character set to be influenced remotely. The attacker then submits data or metadata that causes the application to convert from IBM1390 or IBM1399. When glibc processes that conversion path, the vulnerable assertion can fail and terminate the process, typically through an abort signal. If the affected process is a worker, the attacker may repeat requests to exhaust worker capacity or keep the service unstable; if it is a monolithic or poorly supervised process, a single request may cause a visible outage until the service restarts.

How to fix it

Upgrade GNU glibc to a vendor-provided fixed build when available for the operating system distribution. Because no exact fixed version was provided in the input, use the relevant Linux distribution advisory rather than relying only on upstream version numbers. As an immediate mitigation, remove or disable the IBM1390 and IBM1399 gconv character-set modules on systems that do not require them, and verify they are no longer listed by iconv. Also harden applications so externally supplied character-set names are allowlisted to only required encodings, such as UTF-8, and reject unexpected encodings before calling iconv(). Ensure affected services are supervised and rate-limited so repeated crash attempts do not create a sustained outage.

How to confirm the fix worked

Confirm the installed glibc package version and distribution patch status using the platform package manager and vendor security advisory. Check whether IBM1390 and IBM1399 are still available with commands such as `iconv -l | grep -E 'IBM1390|IBM1399'`; systems that do not need these encodings should return no matches after mitigation. For application validation, test that externally supplied encodings outside the approved allowlist are rejected before reaching iconv(). In staging, reproduce the relevant conversion path only in a controlled way and confirm the service no longer aborts when IBM1390 or IBM1399 is requested. Confirm service logs, crash reporters, and systemd-coredump no longer show new aborts associated with iconv or those character sets.

Typical attack path

1. Find an exposed service that performs server-side character-set conversion using GNU glibc iconv().
2. Determine whether the service accepts attacker-controlled encoding names through request headers, form parameters, file metadata, API fields, uploaded content, email metadata, or import jobs.
3. Send input that requests conversion from IBM1390 or IBM1399.
4. Trigger the vulnerable glibc iconv() assertion path, causing the application process to abort or crash.
5. Repeat the request to maintain denial of service, exhaust worker pools, or disrupt availability after automatic restarts.

How to detect it

To assess prior exploitation, review application access logs, API gateway logs, WAF logs, mail-processing logs, file-upload/import logs, and reverse-proxy logs for requests or metadata containing `IBM1390` or `IBM1399`. Correlate those events with application crashes, HTTP 5xx spikes, worker restarts, systemd service restarts, container restarts, SIGABRT events, and core dumps. On Linux systems, examine journald, syslog, systemd-coredump, kernel logs, container runtime logs, and APM crash traces for aborts involving `iconv`, `gconv`, `glibc`, or assertion failures shortly after requests naming those encodings. Look for repeated patterns from the same source address, user agent, authenticated account, API token, or job source, especially if crash timing aligns with submitted files, emails, import jobs, or requests carrying unusual charset values. Absence of these strings does not fully exclude exploitation because the encoding value may appear only in application-layer payloads that were not logged.

• IBM1390
• IBM1399
• charset=IBM1390
• charset=IBM1399
• encoding=IBM1390
• encoding=IBM1399
• from=IBM1390
• from=IBM1399
• iconv
• gconv
• glibc
• assertion failure
• SIGABRT
• Aborted (core dumped)
• systemd-coredump
• core dumped
• /usr/lib/gconv/IBM1390.so
• /usr/lib/gconv/IBM1399.so
• /usr/lib64/gconv/IBM1390.so
• /usr/lib64/gconv/IBM1399.so

What your security team should do

• Inventory Linux systems and container images using GNU glibc 2.43 or earlier, prioritizing internet-facing services and applications that parse user-controlled text, files, email, or character-set metadata.
• Apply vendor glibc security updates as soon as available; because this is not currently KEV-listed and EPSS is low, prioritize based on exposure to untrusted input and service criticality.
• Immediately disable or remove IBM1390 and IBM1399 character-set support where not operationally required.
• Add application-layer validation to allowlist accepted character encodings and reject IBM1390, IBM1399, and other unnecessary legacy encodings from remote users.
• Search recent logs and crash telemetry for signs of repeated process aborts, SIGABRT events, core dumps, or requests referencing IBM1390 or IBM1399.
• Ensure monitoring alerts on abnormal restart loops, worker crashes, elevated 5xx rates, and service unavailability for applications that perform character-set conversion.
• Rebuild and redeploy container images after glibc fixes or mitigations; do not rely only on patching base hosts if vulnerable glibc is packaged inside containers.