The vulnerability is a heap-based buffer overflow that occurs when iconv(3) processes untrusted input with certain encodings—HZ, UTF-7, VIQR, or ZW—without verifying that the caller's output buffer is large enough to hold the converted data. An attacker can supply specially crafted data that causes iconv to write beyond the bounds of the allocated buffer, corrupting adjacent heap objects, which can lead to arbitrary code execution or denial of service.

The flaw resides in the FreeBSD operating system’s core C library iconv implementation. Any FreeBSD installation that has not installed the security update referenced in the advisory remains vulnerable whenever an application invokes iconv with one of the affected encodings. No specific product versions are listed, so all current releases that include the vulnerable code are potentially affected.

Based on the description, it is inferred that an attacker could supply specially crafted input over a network or local program to trigger iconv on one of the affected encodings (HZ, UTF‑7, VIQR, ZW). The CVSS score of 9.8 indicates high severity for this heap buffer overflow (CWE‑122). EPSS is less than 1% and the vulnerability is not listed in the CISA KEV, indicating a low likelihood of exploitation. Until the update is applied, disabling the affected encodings or implementing application‑level checks would mitigate the risk.