CVE-2019-25013
glibc: buffer over-read in iconv when processing invalid multi-byte input sequences in the EUC-KR encoding
Severity
ModerateRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · September 6, 2019
Updated · November 21, 2025
Description
A flaw was found in glibc. When processing input in the EUC-KR encoding, an invalid input sequence could cause glibc to read beyond the end of a buffer, resulting in a segmentation fault. The highest threat from this vulnerability is to system availability.
Statement
This flaw has been rated as having moderate impact for glibc packages shipped with Red Hat Enterprise Linux because, the maximum impact of this vulnerability is a crash, and it relies on processing untrusted input in an uncommon encoding (EUC-KR). When this encoding is not used, the vulnerability can not be triggered.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.1 · 4.8CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H
CWE-119 · Improper Restriction of Operations within the Bounds of a Memory Buffer