CVE-2026-77117: GNU C Library SHIFT_JISX0213 DOS Vulnerability

CVE-2026-77117 Overview

CVE-2026-77117 is an infinite loop vulnerability in the GNU C Library (glibc) affecting versions 2.3 through 2.44. The flaw resides in the SHIFT_JISX0213 character set converter used by iconv and related wide-character conversion routines. When an application converts attacker-controlled SHIFT_JISX0213 input into UCS-4 or the internal wide-character encoding, and the output buffer is sized to split a two-code-point sequence, the converter fails to clear its pending character state. Applications that retry the conversion enter an infinite loop, causing a denial-of-service condition. The related defect in the EUC_JISX0213 converter is tracked separately as CVE-2026-80489.

Critical Impact
Attacker-controlled input processed through the affected iconv converter can hang the calling application, resulting in denial of service on any process that performs SHIFT_JISX0213 decoding with a small output buffer.

Affected Products

GNU C Library (glibc) versions 2.3 through 2.44
Applications linking against affected glibc versions that call iconv with SHIFT_JISX0213 as the source encoding
Linux distributions bundling vulnerable glibc builds

Discovery Timeline

2026-09-15 - CVE-2026-77117 published to the National Vulnerability Database (NVD)
2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-77117

Vulnerability Analysis

The vulnerability is classified as [CWE-835] Loop with Unreachable Exit Condition. It manifests in the SHIFT_JISX0213 converter shipped with glibc, which is invoked by iconv, iconv_open, and wide-character conversion functions such as mbsrtowcs. The converter is a state machine designed to translate multi-byte sequences into fixed-width code points.

Some SHIFT_JISX0213 byte sequences decode to two Unicode code points rather than one. The converter handles this by emitting the first code point immediately and stashing the second in its conversion state for the next call. This design assumes the caller will consume the pending character and advance the input pointer on subsequent invocations.

The result is a deterministic hang in any process that loops on iconv return values, including web servers, mail transfer agents, text-processing utilities, and language runtimes that wrap glibc conversion primitives.

Root Cause

The converter never clears the pending second code point after emitting it. When the output buffer has room for only one code point, the converter writes the first code point, stores the second in the conversion state, and returns E2BIG. On the next call, it emits the pending character again without consuming any input bytes and without resetting the state, so the same condition repeats indefinitely.

Attack Vector

Exploitation requires two conditions. First, the input passed to the converter must be attacker-controlled and contain a crafted SHIFT_JISX0213 sequence that decodes to two code points. Second, the calling application must invoke the converter with an output buffer small enough to split the two code points across calls. The attack requires no authentication and no user interaction, but the attack complexity is elevated because SHIFT_JISX0213 is not a commonly used encoding, limiting the population of exposed applications.

The vulnerability mechanism is described in the Sourceware GLIBC Security Advisory and analyzed in Sourceware Bug Report #34556. No verified public exploit code is available at time of publication.

Detection Methods for CVE-2026-77117

Indicators of Compromise

Long-running or hung processes consuming 100% CPU on a single core while performing character-set conversion
Web application, mail server, or batch processing threads stuck inside libc.so.6 conversion routines as shown by gdb or perf stack traces
Application logs showing repeated EILSEQ or E2BIG handling loops that never terminate

Detection Strategies

Inventory installed glibc versions across Linux hosts and flag any version between 2.3 and 2.44 inclusive using ldd --version or distribution package queries
Audit application source and dependencies for calls to iconv, iconv_open, or mbsrtowcs that specify SHIFT_JISX0213 as the source encoding
Correlate process CPU spikes with stack samples that resolve to glibc conversion symbols

Monitoring Recommendations

Alert on sustained single-thread CPU saturation in services that accept untrusted text input
Track process hang and watchdog restart events for services performing internationalized text processing
Monitor Linux vendor security feeds for updated glibc package releases addressing this advisory

How to Mitigate CVE-2026-77117

Immediate Actions Required

Identify all systems running glibc versions 2.3 through 2.44 and prioritize patching for hosts that expose services processing untrusted text
Apply the vendor-supplied glibc update as soon as distribution packages become available
Restart long-running services after patching to ensure the updated library is loaded

Patch Information

Refer to the Sourceware GLIBC Security Advisory for the upstream fix and to distribution security trackers for backported packages. The fix ensures the converter clears its pending character state after emitting the second code point, preventing the infinite loop.

Workarounds

Reject or filter SHIFT_JISX0213 as an input encoding in applications that expose encoding selection to untrusted users
Enforce sufficiently large output buffers in code paths that invoke iconv on Japanese character sets to prevent the split-code-point condition
Apply process-level CPU and wall-clock timeouts to conversion routines so a hung worker is terminated rather than consuming resources indefinitely

bash

# Check installed glibc version on Linux hosts
ldd --version | head -n 1

# Debian/Ubuntu: query package version
dpkg -l | grep -E 'libc6|glibc'

# RHEL/Fedora: query package version
rpm -q glibc