CVE-2026-4046

Name	CVE-2026-4046
Description	The iconv() function in the GNU C Library versions 2.43 and earlier may crash due to an assertion failure when converting inputs from the IBM1390 or IBM1399 character sets, which may be used to remotely crash an application. This vulnerability can be trivially mitigated by removing the IBM1390 and IBM1399 character sets from systems that do not need them.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
glibc (PTS)	bullseye	2.31-13+deb11u11	vulnerable
	bullseye (security)	2.31-13+deb11u13	vulnerable
	bookworm	2.36-9+deb12u13	vulnerable
	bookworm (security)	2.36-9+deb12u7	vulnerable
	trixie	2.41-12+deb13u2	vulnerable
	forky	2.42-13	vulnerable
	sid	2.42-14	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
glibc	source	(unstable)	(unfixed)

https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0007