CVE-2021-43396

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-11-04 · updated 2026-10-14

Description

In iconvdata/iso-2022-jp-3.c in the GNU C Library (aka glibc) 2.34, remote attackers can force iconv() to emit a spurious '\0' character via crafted ISO-2022-JP-3 data that is accompanied by an internal state reset. This may affect data integrity in certain iconv() use cases. NOTE: the vendor states "the bug cannot be invoked through user input and requires iconv to be invoked with a NULL inbuf, which ought to require a separate application bug to do so unintentionally. Hence there's no security impact to the bug.

Affected products

GNU C Library (glibc): 2.34
Oracle Communications Cloud Native Core Binding Support Function: 22.1.3
Oracle Communications Cloud Native Core Network Function Cloud Native Environment: 22.1.0
Oracle Communications Cloud Native Core Network Repository Function: 22.1.2, 22.2.0
Oracle Communications Cloud Native Core Security Edge Protection Proxy: 22.1.1
Oracle Communications Cloud Native Core Unified Data Repository: 22.2.0
Oracle Enterprise Operations Monitor: 4.3, 4.4, 5.0

References

Get alerted when CVE-2021-43396 or the next vulnerability affects your stack