---
id: CVE-2026-4046
title: iconv crash due to assertion failure with untrusted input
summary: >-
  The iconv() function in the GNU C Library versions 2.43 and earlier may crash
  due to an assertion failure when converting inputs from the IBM1390 or IBM1399
  character sets, which may be used to remotely crash an application.




  This vuln…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cvssSource: adp
cwe:
  - CWE-617
vendor: The GNU C Library
product: glibc
affected:
  - glibc >= 2.3.3 <= 2.43
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-03-30T17:33:59.227677Z'
exploitAvailable: true
published: '2026-03-30'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T01:12:07.813Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-4046'
references:
  - url: 'https://sourceware.org/bugzilla/show_bug.cgi?id=33980'
  - url: >-
      https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0007;hb=HEAD
  - url: >-
      https://inbox.sourceware.org/libc-announce/76814edf-cf7f-47ec-979d-2dce0a2c76bf@gotplt.org/T/#u
tags:
  - cve.org
  - exploit-available
epss: 0.00662
epssPercentile: 0.50527
ingestedAt: '2026-10-15T05:52:46.050Z'
---

## Overview

The iconv() function in the GNU C Library versions 2.43 and earlier may crash due to an assertion failure when converting inputs from the IBM1390 or IBM1399 character sets, which may be used to remotely crash an application.



This vulnerability can be trivially mitigated by removing the IBM1390 and IBM1399 character sets from systems that do not need them.

## Affected

- `glibc >= 2.3.3 <= 2.43`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.