CVE-2021-43396: gnu glibc
Vulnerability summary
CVE-2021-43396 is a high (CVSS 7.5) vulnerability in gnu glibc. EPSS estimates a 3.29% chance of exploitation in the next 30 days, higher than 88.3% of scored vulnerabilities. 2 public exploits are recorded.
Timeline
- 04-11-2021PublishedVulnerability first disclosed.
- 14-10-2026Last modifiedVulnerability information updated.
Description
In iconvdata/iso-2022-jp-3.c in the GNU C Library (aka glibc) 2.34, remote attackers can force iconv() to emit a spurious '\0' character via crafted ISO-2022-JP-3 data that is accompanied by an internal state reset. This may affect data integrity in certain iconv() use cases. NOTE: the vendor states "the bug cannot be invoked through user input and requires iconv to be invoked with a NULL inbuf, which ought to require a separate application bug to do so unintentionally. Hence there's no security impact to the bug.
CVSS metrics
3 scores · 2 sources · 2 versions- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
EPSS trend
Probability
3.29%
Chance of exploitation in the next 30 days
Percentile
88%
Versus all other CVEs
30-day change
0.00 pp
From 3.29% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
2 foundExploit Reference (sourceware.org)
Maturity: unknown
Exploit Reference (blog.tuxcare.com)
Maturity: unknown
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Oracle6 products
- communications_cloud_native_core_binding_support_function22.1.3
- communications_cloud_native_core_network_function_cloud_native_environment22.1.0
- communications_cloud_native_core_network_repository_function22.1.2 | 22.2.0
- communications_cloud_native_core_security_edge_protection_proxy22.1.1
- communications_cloud_native_core_unified_data_repository22.2.0
Debian1 product
- glibc< 2.32-5
Gnu1 product
- glibc2.34
3 vendors · 8 products
References
7 links- sourceware.org/bugzilla/show_bug.cgi?id=28524X Refsource MISCExploitIssue TrackingThird Party Advisory
- blog.tuxcare.com/vulnerability/vulnerability-in-iconv-identified-by-tuxcare-team-cve-2021-43396X Refsource MISCExploitThird Party Advisory
