CVE-2026-58082: ISO-2022 Encoding Buffer Overflow Flaw

CVE-2026-58082 Overview

CVE-2026-58082 is a stack buffer overflow [CWE-121] in the ISO-2022 encoding module of the FreeBSD iconv(3) character conversion library. The module allocates a stack buffer sized to MB_LEN_MAX (6 bytes) for intermediate character output. Certain ISO-2022 variants can require up to 10 bytes per character, producing an overflow of up to four bytes on the stack. Applications that call iconv(3) to convert untrusted input to or from an affected encoding may be exploitable through this condition.

Critical Impact
Any FreeBSD application that converts attacker-controlled text through an affected ISO-2022 variant can trigger a stack buffer overflow, potentially enabling memory corruption or code execution.

Affected Products

FreeBSD iconv(3) — ISO-2022 encoding modules
Applications on FreeBSD that convert untrusted input to or from ISO-2022 variants
See the FreeBSD Security Advisory SA-26:49 for exact affected releases

Discovery Timeline

2026-08-19 - CVE-2026-58082 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-58082

Vulnerability Analysis

The ISO-2022 family of character encodings uses escape sequences to shift between character sets, including single-byte ASCII, multi-byte CJK sets, and designator sequences. The FreeBSD iconv(3) implementation of these encodings uses an on-stack scratch buffer sized to MB_LEN_MAX, which is defined as 6 bytes. That size is sufficient for most encodings but not for the full range of ISO-2022 output sequences, which can consume up to 10 bytes for a single logical character. When a conversion routine writes a longer sequence into that fixed 6-byte buffer, it overwrites adjacent stack memory, including saved registers, frame pointers, or return addresses depending on compiler layout.

Root Cause

The root cause is an incorrect buffer size assumption. The developers sized the intermediate buffer to MB_LEN_MAX, treating it as an upper bound for any single character output. ISO-2022 variants violate that assumption because designator and shift sequences are counted alongside character bytes. No bounds check gates the write, so the overflow occurs whenever a supported variant emits a long sequence.

Attack Vector

An attacker supplies crafted input to any application that passes data through iconv(3) using one of the affected encodings. Common exposure points include mail user agents processing message headers, web servers converting request bodies, database clients handling encoded strings, and command-line tools converting file contents. The attacker does not need local access when the vulnerable conversion is reachable through a network-facing service. Successful exploitation depends on stack layout and platform mitigations such as stack canaries, ASLR, and W^X memory protections.

No public proof-of-concept code is available. See the FreeBSD Security Advisory SA-26:49 for the vendor's technical description and patch details.

Detection Methods for CVE-2026-58082

Indicators of Compromise

Unexpected crashes, SIGSEGV, or stack canary aborts in processes that call iconv(3)
Core dumps referencing ISO-2022 conversion functions in libc iconv modules
Anomalous input containing ISO-2022 escape sequences such as ESC $ ) or ESC $ ( directed at services that do not normally receive such content

Detection Strategies

Inventory processes that link against libc iconv and accept external input, then treat them as high-priority monitoring targets
Inspect application and system logs for repeated conversion errors or worker restarts correlated with ISO-2022 payloads
Deploy runtime memory-safety tooling such as AddressSanitizer in test environments to confirm the overflow path is reachable in your application

Monitoring Recommendations

Alert on unexpected child process crashes for mail, web, and database daemons on FreeBSD hosts
Capture and review any core files produced by services that perform charset conversion
Track outbound network activity from services after conversion errors, which may indicate post-exploitation behavior

How to Mitigate CVE-2026-58082

Immediate Actions Required

Apply the FreeBSD patch referenced in FreeBSD Security Advisory SA-26:49 to all affected hosts
Restart every long-running service that links against libc so the fixed iconv module is loaded
Audit applications for direct or indirect use of ISO-2022 conversions and restrict accepted encodings where possible

Patch Information

FreeBSD has issued a security advisory with corrected source and binary patches. The fix increases the intermediate buffer to accommodate the maximum sequence length produced by any supported ISO-2022 variant. Follow the standard FreeBSD update procedure using freebsd-update fetch install on supported releases, then reboot or restart affected services. Review the advisory for exact patch levels per release branch.

Workarounds

Reject or normalize input encoded as ISO-2022-JP, ISO-2022-KR, ISO-2022-CN, and related variants at the application boundary until patching is complete
Restrict the list of encodings accepted by user-controllable conversion APIs to a safe allowlist
Run exposed conversion services under capsicum or other sandboxes to constrain the impact of memory corruption

bash

# Update FreeBSD base system and reboot to apply libc fixes
freebsd-update fetch
freebsd-update install
shutdown -r now