Converting a crafted BIG‑HKSCS input stream to UCS‑4 or the internal wide‑character representation via glibc’s iconv may cause the conversion routine to make no progress, eventually leading the calling application to hang. This results in a denial of service for legitimate users. The flaw is an uncontrolled resource consumption condition (CWE‑835). Based on the description, it is inferred that the crafted input can be supplied by an attacker to any application using iconv for that conversion.

The defect exists in the GNU C Library (glibc) implementations used by many Linux distributions. Versions 2.18 through 2.31 are affected. Applications that invoke iconv for the BIG‑HKSCS→UCS‑4 conversion path—including web servers, file‑processing utilities, and other services—may be impacted.

The vulnerability scores a CVSS of 5.9, indicating moderate severity. EPSS data is not available, so the likelihood of exploitation is unclear. It is not listed in the CISA KEV catalog. The likely attack vector is delivering crafted BIG‑HKSCS data to applications that invoke iconv for that conversion path. Based on the description, it is inferred that an attacker can trigger the hang by providing such crafted input to any program that performs the conversion. The risk is primarily for processes that process such input, as the vulnerability requires the presence of the vulnerable conversion routine.