CVE-2025-26519 Memory corruption in musl
An out-of-bounds write in musl libc allows attackers to execute code or cause denial of service via crafted EUC-KR text conversion.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-26519?
CVE-2025-26519 is a high-severity memory corruption vulnerability in musl-libc musl, published on 14 Feb 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
musl libc 0.9.13 through 1.2.5 before 1.2.6 has an out-of-bounds write vulnerability when an attacker can trigger iconv conversion of untrusted EUC-KR text to UTF-8.
Weakness: CWE-787
Which versions are affected by CVE-2025-26519?
It affects 1 product.
Products include Musl-Libc Musl.
How do I fix CVE-2025-26519?
Upgrade to a fixed version.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2025-26519 being exploited?
There is no known exploitation of CVE-2025-26519 in the wild and no public exploit code.
Other vulnerabilities in musl-libc musl
Sources
Also known as ALPINE-CVE-2025-26519, BELL-CVE-2025-26519, DEBIAN-CVE-2025-26519, GHSA-xpv5-92cc-8f65, OESA-2025-1252, OESA-2025-1253 and 4 more.