CVE-2026-77117: 
Wolfi vulnerability analysis and mitigation

CVE-2026-77117 is a denial-of-service vulnerability in the GNU C Library (glibc) caused by a non-progress infinite loop in the SHIFT_JISX0213 to UCS-4 character set conversion path. A remote attacker can supply specially crafted input that causes the converter to repeatedly emit a buffered code point without consuming further input, resulting in persistent retry churn and application hang. The flaw was disclosed on August 25, 2026, and affects glibc versions including glibc-2.42-11.1 and earlier. It carries a CVSS v3.1 base score of 5.9 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-835 (Loop with Unreachable Exit Condition / 'Infinite Loop'), located in iconvdata/shift_jisx0213.c within the from_shift_jisx0213 function's BODY macro. Exploitation requires an attacker to supply a 2-byte SHIFT_JISX0213 sequence that expands through __jisx0213_to_ucs_combining, producing two UCS-4 code points, while the output buffer has only enough space for the first. When the caller retries after receiving E2BIG with the same conversion state, the converter re-emits the buffered code point without advancing input, creating an infinite retry loop. Applications that never use the SHIFT_JISX0213 conversion path, or that abort on repeated no-progress E2BIG errors, are not practically exposed (Red Hat Bugzilla).

Successful exploitation results in a denial of service, causing the affected application to hang indefinitely while processing untrusted text input. The impact is limited to availability — there is no confidentiality or integrity impact. Any application that converts untrusted user-supplied text from SHIFT_JISX0213 to UCS-4 using glibc's iconv facility is at risk, which could include web services, text processing pipelines, or internationalization-aware applications (Red Hat Advisory, Ubuntu USN-8737-1).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2026-77117. The CVE status was listed as "Reserved" at time of initial disclosure, and no CISA KEV catalog entry exists. Exploitation requires high attack complexity — the attacker must control input to a specific conversion path and the caller must retry after E2BIG with the same state — limiting practical exposure. The vulnerability was detected by Nessus plugin 341011 (Red Hat Bugzilla, Feedly).

Ubuntu has released patched package versions addressing this vulnerability: Ubuntu 26.04 LTS (libc6 2.43-2ubuntu2.4), Ubuntu 24.04 LTS (libc6 2.39-0ubuntu8.9), and Ubuntu 22.04 LTS (libc6 2.35-0ubuntu3.15). A standard system update (apt upgrade) will apply the necessary fixes. As a workaround, applications that abort on repeated no-progress E2BIG errors from iconv rather than retrying with the same conversion state are not practically exposed (Ubuntu USN-8737-1, Ubuntu USN-8737-2).