CVE-2026-57053

A flaw was found in GNU libidn. This vulnerability allows an attacker to cause out-of-bounds reads of uninitialized memory within the ToUnicode APIs due to mishandling in the idna_to_unicode_internal function. This could lead to information disclosure or a denial of service.

This flaw resides in GNU libidn's idna_to_unicode_internal() function, used by the idna_to_unicode_* API family. The function assumes its internal ToASCII comparison buffer always begins with the "xn--" ACE prefix. When a decoded label is pure ASCII and shorter than four characters, no prefix is added, and the round-trip verification instead reads past the buffer's null terminator into uninitialized stack memory. Under certain call sequences that leave matching residual data on the stack, this allows an ACE-encoded label that should fail validation to be silently accepted and normalized to a different, shorter string, which could affect domain-based security decisions (allow/deny-list matching, hostname comparisons, routing, logging) made by applications relying on the result.

This flaw does not affect libidn2. Its round-trip verification in lookup.c never assumes the "xn--" prefix is present on caller-supplied data; every prefix-relative offset is either guarded by an explicit prefix check beforehand or applied to a buffer the function itself just wrote the prefix into, and it compares the full label rather than a bare suffix.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

No configuration-level mitigation is available; triggering the incorrect result depends on uninitialized stack content from earlier processing, so behavior is non-deterministic and cannot be reliably suppressed via input filtering. Users should update to a fixed libidn package once available. Applications that must process untrusted internationalized domain names before a fix is available should treat output of idna_to_unicode_8z8z()/idna_to_unicode_8zlz() as unverified, perform an independent comparison against the original ACE-encoded input, or use libidn2 for IDNA processing, which is not affected.