---
id: CVE-2021-3326
title: >-
  The iconv function in the GNU C Library (aka glibc or libc6) 2.32 and earlier,
  when processing invalid input sequences in the ISO-2022-JP-3 encoding, fails
  an assertion in the code path and aborts the program, potentially resulting in
  a …
summary: >-
  The iconv function in the GNU C Library (aka glibc or libc6) 2.32 and earlier,
  when processing invalid input sequences in the ISO-2022-JP-3 encoding, fails
  an assertion in the code path and aborts the program, potentially resulting in
  a …
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-617
  - CWE-617
vendor: gnu
product: glibc
affected:
  - glibc <= 2.32.0
  - 'e-series_santricity_os_controller >= 11.0, <= 11.60.3'
  - ontap_select_deploy_administration_utility
  - communications_cloud_native_core_security_edge_protection_proxy = 1.5.0
  - m10-1_firmware < xcp2410
  - m10-4_firmware < xcp2410
  - m10-4s_firmware < xcp2410
  - m12-1_firmware < xcp2410
  - m12-2_firmware < xcp2410
  - m12-2s_firmware < xcp2410
  - m10-1_firmware < xcp3110
  - m10-4_firmware < xcp3110
  - m10-4s_firmware < xcp3110
  - m12-1_firmware < xcp3110
  - m12-2_firmware < xcp3110
  - m12-2s_firmware < xcp3110
  - debian_linux = 10.0
patched:
  - m10-1_firmware xcp3110
  - m10-4_firmware xcp3110
  - m10-4s_firmware xcp3110
  - m12-1_firmware xcp3110
  - m12-2_firmware xcp3110
  - m12-2s_firmware xcp3110
published: '2021-01-27'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T10:17:41.007'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2021-3326'
references:
  - url: 'http://www.openwall.com/lists/oss-security/2021/01/28/2'
    label: cve@mitre.org
  - url: 'https://lists.debian.org/debian-lts-announce/2022/10/msg00021.html'
    label: cve@mitre.org
  - url: 'https://security.gentoo.org/glsa/202107-07'
    label: cve@mitre.org
  - url: 'https://security.netapp.com/advisory/ntap-20210304-0007/'
    label: cve@mitre.org
  - url: 'https://sourceware.org/bugzilla/show_bug.cgi?id=27256'
    label: cve@mitre.org
  - url: >-
      https://sourceware.org/git/?p=glibc.git%3Ba=commit%3Bh=7d88c6142c6efc160c0ee5e4f85cde382c072888
    label: cve@mitre.org
  - url: 'https://www.oracle.com/security-alerts/cpuapr2022.html'
    label: cve@mitre.org
  - url: 'https://www.oracle.com/security-alerts/cpujan2022.html'
    label: cve@mitre.org
  - url: 'http://www.openwall.com/lists/oss-security/2021/01/28/2'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://lists.debian.org/debian-lts-announce/2022/10/msg00021.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://security.gentoo.org/glsa/202107-07'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://security.netapp.com/advisory/ntap-20210304-0007/'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://sourceware.org/bugzilla/show_bug.cgi?id=27256'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://sourceware.org/git/?p=glibc.git%3Ba=commit%3Bh=7d88c6142c6efc160c0ee5e4f85cde382c072888
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://www.oracle.com/security-alerts/cpuapr2022.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://www.oracle.com/security-alerts/cpujan2022.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-398330.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-831302.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
tags:
  - nvd
epss: 0.03093
epssPercentile: 0.8741
ingestedAt: '2026-10-14T10:25:41.188Z'
---

## Overview

The iconv function in the GNU C Library (aka glibc or libc6) 2.32 and earlier, when processing invalid input sequences in the ISO-2022-JP-3 encoding, fails an assertion in the code path and aborts the program, potentially resulting in a denial of service.

## Affected

- `glibc <= 2.32.0`
- `e-series_santricity_os_controller >= 11.0, <= 11.60.3`
- `ontap_select_deploy_administration_utility`
- `communications_cloud_native_core_security_edge_protection_proxy = 1.5.0`
- `m10-1_firmware < xcp2410`
- `m10-4_firmware < xcp2410`
- `m10-4s_firmware < xcp2410`
- `m12-1_firmware < xcp2410`
- `m12-2_firmware < xcp2410`
- `m12-2s_firmware < xcp2410`
- `m10-1_firmware < xcp3110`
- `m10-4_firmware < xcp3110`
- `m10-4s_firmware < xcp3110`
- `m12-1_firmware < xcp3110`
- `m12-2_firmware < xcp3110`
- `m12-2s_firmware < xcp3110`
- `debian_linux = 10.0`

## Remediation

Upgrade past the affected range:

- `m10-1_firmware xcp3110`
- `m10-4_firmware xcp3110`
- `m10-4s_firmware xcp3110`
- `m12-1_firmware xcp3110`
- `m12-2_firmware xcp3110`
- `m12-2s_firmware xcp3110`