Description
GNU libidn before 1.44 is prone to out-of-bounds reads of uninitialized memory in the ToUnicode APIs because of mishandling in idna_to_unicode_internal. The affected code is not present in libidn2.
Published: 2026-06-23
Score: 4 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is an out-of-bounds read of uninitialized memory within the ToUnicode APIs of GNU libidn, caused by mishandling in the idna_to_unicode_internal function. The read can expose data from adjacent memory, potentially revealing sensitive information. This weakness is classified as CWE-1284 and does not provide an avenue for code execution.

Affected Systems

The affected product is the GNU libidn library, versions prior to 1.44. Versions 1.44 and later contain the fix. The library is commonly incorporated into applications that require Internationalized Domain Name support.

Risk and Exploitability

The CVSS score of 4 indicates low severity. EPSS data is not available and the vulnerability is not listed in CISA KEV. Exploitation requires an attacker to invoke the ToUnicode API with crafted input that triggers the out-of-bounds read. Prompt remediation is recommended.

Generated by OpenCVE AI on June 23, 2026 at 19:18 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade GNU libidn to version 1.44 or later.
  • If an upgrade is not possible, disable or avoid use of the ToUnicode APIs, or replace libidn with libidn2.
  • Ensure any data passed to idna_to_unicode_internal comes from trusted or sanitized sources.

Generated by OpenCVE AI on June 23, 2026 at 19:18 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 23 Jun 2026 19:45:00 +0000

Type Values Removed Values Added
Title Out‑of‑Bounds Read in libidn’s ToUnicode API

Tue, 23 Jun 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 23 Jun 2026 17:30:00 +0000

Type Values Removed Values Added
Description GNU libidn before 1.44 is prone to out-of-bounds reads of uninitialized memory in the ToUnicode APIs because of mishandling in idna_to_unicode_internal. The affected code is not present in libidn2.
First Time appeared Gnu
Gnu libidn
Weaknesses CWE-1284
CPEs cpe:2.3:a:gnu:libidn:*:*:*:*:*:*:*:*
Vendors & Products Gnu
Gnu libidn
References
Metrics cvssV3_1

{'score': 4, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L'}

Subscriptions

Gnu Libidn
cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2026-06-23T17:40:14.173Z

Reserved: 2026-06-23T16:40:22.560Z

Link: CVE-2026-57053

cve-icon Vulnrichment

Updated: 2026-06-23T17:40:10.988Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-06-23T19:30:04Z

Weaknesses
  • CWE-1284

    Improper Validation of Specified Quantity in Input