CVE-2026-80489

A flaw was found in glibc. Converting crafted EUC_JISX0213 input to UCS-4 or the internal wide character encoding (for example with iconv) can cause the converter to make no progress, hanging the calling application. Some EUC_JISX0213 sequences decode to two code points; if the output buffer has room for only the first, the second is stored in conversion state and returned as E2BIG, but that pending character is never cleared after it is emitted on the next call, so retries loop forever without consuming further input.

This Moderate denial-of-service flaw in glibc's EUC_JISX0213 to UCS-4 conversion requires attacker-controlled input on that uncommon charset path and an application that retries conversion with an output buffer small enough to split a two-code-point sequence. Impact is limited to process hang (availability only). The related SHIFT_JISX0213 defect is tracked separately as CVE-2026-77117.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this avoid converting untrusted data with that charset, or disable the conversion path if unused. Where conversion of untrusted input cannot be avoided, restrict access to trusted clients and apply process CPU/resource limits to contain hang impact.