CVE-2025-26519: 
NixOS vulnerability analysis and mitigation

A critical vulnerability (CVE-2025-26519) was discovered in musl libc versions 0.9.13 through 1.2.5. The vulnerability manifests as an out-of-bounds write condition in the iconv implementation when processing untrusted EUC-KR text for conversion to UTF-8. This issue was discovered and reported by Nick Wellnhofer, affecting all versions since the introduction of EUC-KR support until version 1.2.6 (Openwall Report).

The vulnerability stems from a combination of two issues: incorrect input byte validation in the EUC-KR decoder and an assumption in the UTF-8 output encoder that the input decoder only produces valid Unicode Scalar Values. When triggered, certain invalid inputs that should produce an encoding error instead result in out-of-bounds loads from the ksc table. In worst-case scenarios, if the loaded value is not a valid unicode scalar value and the output encoding is UTF-8, wctomb returns (size_t)-1, causing an overflow in the output pointer and remaining buffer size. The vulnerability has been assigned a CVSS v3.1 Base Score of 8.1 (HIGH) with vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L (NVD).

The vulnerability can result in out-of-bounds memory writes in applications that process untrusted input using iconv where the input charset for the conversion is input-controlled. This particularly affects applications that use declared MIME charset of untrusted input (such as in XML, HTML, or MIME-encoded email) for converting arbitrary-encoding input to UTF-8. The potential impact includes memory corruption and possible remote code execution (Security Online).

The vulnerability requires specific conditions to be exploited: an application must call iconv_open with UTF-8 as the output encoding and EUC-KR as the input encoding, and then process untrusted input using the resulting conversion descriptor. The bug was initially discovered through basic fuzz testing of the iconv API (Openwall Discussion).

Several mitigation options are available: 1) Users should upgrade to musl libc version 1.2.6 or later, 2) Apply provided source patches that fix the input byte validation and harden the UTF-8 output code path, 3) For static-linked binaries that cannot be relinked, a binary patching workaround is available by replacing the charset name sequence 'euckr\0ksc5601\0ksx1001\0cp949\0' with dashes to disable EUC-KR support (Openwall Report).