Evil-DB LogoEvil-DB
← All CVEs

CVE-2026-58081

critical · 9.8

Several encoding modules, including HZ, UTF-7, VIQR, and ZW, did not properly check the size of the caller-supplied output buffer before writing converted characters. An application that uses iconv(3) to convert untrusted input to or from one of the affected encodings may be vulnerable to buffer overflows if it uses one of the affected encoding modules.

9.8
CVSS
0.5%
EPSS (exploit prob.)
44th
EPSS percentile
2026-08-19
Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-122

Affected products

VendorProductAffected versions
freebsdfreebsd14.3
freebsdfreebsd14.3
freebsdfreebsd14.3
freebsdfreebsd14.3
freebsdfreebsd14.3
freebsdfreebsd14.3
freebsdfreebsd14.3
freebsdfreebsd14.3
freebsdfreebsd14.3
freebsdfreebsd14.3
freebsdfreebsd14.3
freebsdfreebsd14.3
freebsdfreebsd14.3
freebsdfreebsd14.3
freebsdfreebsd14.3
freebsdfreebsd14.3
freebsdfreebsd14.4
freebsdfreebsd14.4
freebsdfreebsd14.4
freebsdfreebsd14.4
freebsdfreebsd14.4
freebsdfreebsd14.4
freebsdfreebsd14.4
freebsdfreebsd14.4
freebsdfreebsd15.0
freebsdfreebsd15.0
freebsdfreebsd15.0
freebsdfreebsd15.0
freebsdfreebsd15.0
freebsdfreebsd15.0
freebsdfreebsd15.0
freebsdfreebsd15.0
freebsdfreebsd15.0
freebsdfreebsd15.0
freebsdfreebsd15.0
freebsdfreebsd15.1
freebsdfreebsd15.1
freebsdfreebsd15.1

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2026-58081