CVE-2026-80489: GNU C Library EUC_JISX0213 DOS Vulnerability

CVE-2026-80489 Overview

CVE-2026-80489 is an infinite loop vulnerability in the GNU C Library (glibc) EUC_JISX0213 character set converter. The flaw affects glibc versions 2.3 through 2.44 and can be triggered when applications convert attacker-controlled EUC_JISX0213 input to UCS-4 or the internal wide character encoding through interfaces such as iconv. When the output buffer is too small to hold both code points produced by certain multi-output sequences, the converter fails to clear a pending character from the conversion state. Applications that retry the conversion loop indefinitely without consuming further input, resulting in a denial of service. A related defect in the SHIFT_JISX0213 converter is tracked as CVE-2026-77117.

Critical Impact
Attacker-controlled input processed through the EUC_JISX0213 converter with an undersized output buffer causes the calling application to hang indefinitely, consuming CPU and denying service. [CWE-835]

Affected Products

GNU C Library (glibc) version 2.3 through 2.44
Applications linking against glibc that invoke iconv with the EUC_JISX0213 character set
Systems that process untrusted text through affected conversion routines

Discovery Timeline

2026-09-15 - CVE-2026-80489 published to NVD
2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-80489

Vulnerability Analysis

The vulnerability resides in the glibc EUC_JISX0213 to UCS-4 conversion path. Some EUC_JISX0213 byte sequences decode into two Unicode code points rather than one. The converter must emit both code points into the caller's output buffer to fully consume the input sequence.

When the output buffer has room for only the first code point, the converter emits it and stores the second code point in the conversion state. It then returns E2BIG to signal that the caller should provide additional output space. On the next invocation, the converter emits the pending code point from the state but fails to clear that pending value. Every subsequent call re-emits the same pending character without advancing the input pointer, producing an infinite loop in any application that retries conversion until input is exhausted.

Root Cause

The defect is a state management error classified as [CWE-835] (Loop with Unreachable Exit Condition). The converter writes the second decoded code point into the conversion state as a pending output, but the code path that emits the pending character on subsequent calls omits the step that resets the state field. Because the input pointer is not advanced during pending-character emission, the exit condition for the retry loop is never satisfied.

Attack Vector

Exploitation requires three conditions. First, an attacker must supply input that reaches an iconv conversion configured for EUC_JISX0213. Second, that input must contain at least one sequence that decodes to two code points. Third, the calling application must invoke the converter with an output buffer sized to split the two code points and must retry the conversion on E2BIG. Network-facing services that accept internationalized text and convert it using this character set are the most likely exposure surface, though the EUC_JISX0213 encoding is uncommon in modern deployments.

No public proof-of-concept exploit is listed in the enriched data. Technical details are available in the Sourceware Bug Report #34568 and the Sourceware GLIBC Security Advisory.

Detection Methods for CVE-2026-80489

Indicators of Compromise

Application processes consuming 100% CPU on a single thread with no forward progress in I/O or logging activity
Repeated iconv or iconv_r calls returning E2BIG against the same input offset without advancing
Hung service processes that were last observed handling text input tagged as EUC-JIS-2004, EUC_JISX0213, or related aliases

Detection Strategies

Inventory installed glibc versions across Linux hosts and flag any system running versions 2.3 through 2.44
Audit application code and third-party libraries for use of iconv_open with the EUC_JISX0213 character set
Correlate process CPU-hang telemetry with recent inbound requests containing non-ASCII payloads to identify triggering inputs

Monitoring Recommendations

Alert on long-running worker threads in services that perform character set conversion on user-supplied data
Track glibc package versions through configuration management and vulnerability scanners referencing the Sourceware advisory
Monitor for repeated E2BIG return codes in application logs where iconv is instrumented

How to Mitigate CVE-2026-80489

Immediate Actions Required

Identify hosts running glibc 2.3 through 2.44 and prioritize patching for systems that process untrusted input
Review application dependencies for iconv usage against the EUC_JISX0213 character set and constrain callers to trusted input sources
Enforce reasonable timeouts and CPU limits on worker processes that perform text conversion to bound the impact of a hang

Patch Information

Apply the fix distributed by upstream glibc as referenced in the Sourceware GLIBC Security Advisory and Linux distribution advisories that repackage the corrected converter. Rebuild or restart long-running services after upgrading the shared library so the patched code path is loaded.

Workarounds

Reject or transcode inbound text before it reaches EUC_JISX0213 conversion by normalizing to UTF-8 at the network boundary
Size output buffers used with iconv large enough to hold all decoded code points from any input sequence to avoid the split condition
Wrap iconv retry loops with an iteration cap that treats repeated E2BIG without input advancement as a fatal error

bash

# Identify installed glibc version on Linux hosts
ldd --version | head -n 1

# List conversion modules available on the system
iconv -l | grep -i jisx0213