CVE-2026-4046 iconv crash due to assertion failure with untrusted input

What is CVE-2026-4046?

CVE-2026-4046 is a high-severity denial of service vulnerability in Gnu Glibc, published on 30 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The iconv() function in the GNU C Library versions 2.43 and earlier may crash due to an assertion failure when converting inputs from the IBM1390 or IBM1399 character sets, which may be used to remotely crash an application.

This vulnerability can be trivially mitigated by removing the IBM1390 and IBM1399 character sets from systems that do not need them.

Weakness: CWE-617

Which versions are affected by CVE-2026-4046?

It affects 1 product.

Products include Gnu Glibc.

How do I fix CVE-2026-4046?

Change a configuration setting.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2026-4046 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-4046 exists.

Other vulnerabilities in Gnu Glibc

• CVE-2026-5450 scanf %mc off-by-one heap buffer overflow Critical 9.8
• CVE-2023-25139 Memory corruption in n/a Critical 9.8
• CVE-1999-0199 Other in n/a Critical 9.8
• CVE-2019-1010022 Security feature bypass in glibc Critical 9.8
• CVE-2005-3590 Memory corruption in n/a Critical 9.8

All Gnu Glibc vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as ALSA-2026:20587, ALSA-2026:20594, AZL-81273, BELL-CVE-2026-4046, CLSA-2026-1779733763, CLSA-2026-1780135072 and 27 more.