Description
GNU libidn before 1.44 is prone to out-of-bounds reads of uninitialized memory in the ToUnicode APIs because of mishandling in idna_to_unicode_internal. The affected code is not present in libidn2.
Published: 2026-06-23
Score: 4 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is an out-of-bounds read of uninitialized memory within the ToUnicode APIs of GNU libidn, caused by mishandling in the idna_to_unicode_internal function. The read can expose data from adjacent memory, potentially revealing sensitive information. This weakness is classified as CWE-1284 and does not provide an avenue for code execution.

Affected Systems

The GNU libidn library is affected. No specific version details are provided.

Risk and Exploitability

The CVSS score of 4 indicates low severity. Exploitation requires an attacker to invoke the ToUnicode API with crafted input that triggers the out-of-bounds read. Peripheral memory content may be exposed, leading to information disclosure. Prompt remediation is recommended. The vulnerability is not listed in CISA’s KEV catalog, and the EPSS score of < 1% indicates a very low but non-zero chance of exploitation.

Generated by OpenCVE AI on June 24, 2026 at 14:47 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update GNU libidn to the latest available version.
  • If an upgrade is not possible, disable or avoid use of the ToUnicode APIs or replace libidn with libidn2.
  • Ensure any data passed to idna_to_unicode_internal comes from trusted or sanitized sources.

Generated by OpenCVE AI on June 24, 2026 at 14:47 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Ubuntu USN Ubuntu USN USN-8521-1 Libidn vulnerability
History

Wed, 24 Jun 2026 15:15:00 +0000

Type Values Removed Values Added
Title Out-of-Bounds Read in GNU libidn ToUnicode APIs Leading to Information Disclosure

Wed, 24 Jun 2026 05:15:00 +0000

Type Values Removed Values Added
Title Out-of-Bounds Read of Uninitialized Memory in libidn ToUnicode APIs

Wed, 24 Jun 2026 01:00:00 +0000

Type Values Removed Values Added
Title Out-of-Bounds Read of Uninitialized Memory in libidn ToUnicode APIs

Tue, 23 Jun 2026 22:15:00 +0000

Type Values Removed Values Added
Title Out‑of‑Bounds Read in libidn’s ToUnicode API

Tue, 23 Jun 2026 19:45:00 +0000

Type Values Removed Values Added
Title Out‑of‑Bounds Read in libidn’s ToUnicode API

Tue, 23 Jun 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 23 Jun 2026 17:30:00 +0000

Type Values Removed Values Added
Description GNU libidn before 1.44 is prone to out-of-bounds reads of uninitialized memory in the ToUnicode APIs because of mishandling in idna_to_unicode_internal. The affected code is not present in libidn2.
First Time appeared Gnu
Gnu libidn
Weaknesses CWE-1284
CPEs cpe:2.3:a:gnu:libidn:*:*:*:*:*:*:*:*
Vendors & Products Gnu
Gnu libidn
References
Metrics cvssV3_1

{'score': 4, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L'}

Subscriptions

Gnu Libidn
cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2026-06-23T17:40:14.173Z

Reserved: 2026-06-23T16:40:22.560Z

Link: CVE-2026-57053

cve-icon Vulnrichment

Updated: 2026-06-23T17:40:10.988Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-06-24T15:00:06Z

Weaknesses
  • CWE-1284

    Improper Validation of Specified Quantity in Input