CVE-2026-58081

A flaw was found in iconv. Several encoding modules, including HZ, UTF-7, VIQR, and ZW, did not properly validate the size of the provided output buffer before writing converted characters. This oversight could allow an application using iconv to convert untrusted input with one of the affected encodings to experience buffer overflows, potentially leading to denial of service or arbitrary code execution.

This vulnerability is rated as an Important impact because memory corruption during character set conversion can potentially allow arbitrary code execution or service termination when processing untrusted data. Red Hat Enterprise Linux is not affected by this issue because it utilizes the GNU C Library implementation of iconv instead of the FreeBSD iconv codebase. Consequently, the vulnerable encoding routines are not present in Red Hat environments.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.