musl libc 0.9.13 through 1.2.5 before 1.2.6 has an out-of-bounds write vulnerability when an attacker can trigger iconv conversion of untrus

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• musl-libc musl0.9.13 and later · before 1.2.6

Versions reported by the vendor

Affected version ranges reported by the assigning authority (mitre). Independent of NVD's CPE analysis and usually ahead of it.

• musl-libc musl

  • 0.9.13 and later · before 1.2.6affected · semver

Package-level exposure

OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.

Other highest-scoring records for the same primary product.

• CVE-2014-3484Multiple stack-based buffer overflows in the __dn_expand function in network/dn_expand.c in musl libc 1.1x before 1.1.2 and 0.9.13 through 1
  40Plan
• CVE-2019-14697musl libc through 1.1.23 has an x87 floating-point stack adjustment imbalance, related to the math/i386/ directory.
  40Plan
• CVE-2015-1817Stack-based buffer overflow in the inet_pton function in network/inet_pton.c in musl libc 0.9.15 through 1.0.4, and 1.1.0 through 1.1.7 allo
  40Plan
• CVE-2026-40200An issue was discovered in musl libc 0.7.10 through 1.2.6.
  32Monitor
• CVE-2017-15650musl libc before 1.1.17 has a buffer overflow via crafted DNS replies because dns_parse_callback in network/lookup_name.c does not restrict
  31Monitor
• CVE-2020-28928In musl libc through 1.2.1, wcsnrtombs mishandles particular combinations of destination buffer size and source character limit, as demonstr
  22Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.

MITRE has no CAPEC/ATT&CK mapping for this CWE.