CVE-2025-26519: 
Linux Debian vulnerability analysis and mitigation

A critical vulnerability (CVE-2025-26519) was discovered in musl libc versions 0.9.13 through 1.2.5. The vulnerability manifests as an out-of-bounds write condition in the iconv implementation when processing untrusted EUC-KR text for conversion to UTF-8. This issue was discovered and reported by Nick Wellnhofer, affecting all versions since the introduction of EUC-KR support until version 1.2.6 (Openwall Report).

The vulnerability stems from a combination of two issues: incorrect input byte validation in the EUC-KR decoder and an assumption in the UTF-8 output encoder that the input decoder only produces valid Unicode Scalar Values. When triggered, certain invalid inputs that should produce an encoding error instead result in out-of-bounds loads from the ksc table. In worst-case scenarios, if the loaded value is not a valid unicode scalar value and the output encoding is UTF-8, wctomb returns (size_t)-1, causing an overflow in the output pointer and remaining buffer size. The vulnerability has been assigned a CVSS v3.1 Base Score of 8.1 (HIGH) with vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L (NVD).

The vulnerability can result in out-of-bounds memory writes in applications that process untrusted input using iconv where the input charset for the conversion is input-controlled. This particularly affects applications that use declared MIME charset of untrusted input (such as in XML, HTML, or MIME-encoded email) for converting arbitrary-encoding input to UTF-8. The potential impact includes memory corruption and possible remote code execution (Security Online).

Several mitigation options are available: 1) Users should upgrade to musl libc version 1.2.6 or later, 2) Apply provided source patches that fix the input byte validation and harden the UTF-8 output code path, 3) For static-linked binaries that cannot be relinked, a binary patching workaround is available by replacing the charset name sequence 'euckr\0ksc5601\0ksx1001\0cp949\0' with dashes to disable EUC-KR support (Openwall Report).