The vulnerability is a heap‑based buffer overflow that occurs when iconv(3) processes untrusted input with certain encodings—HZ, UTF‑7, VIQR, or ZW—without verifying that the caller’s output buffer is large enough to hold the converted data. An attacker can supply specially crafted data that causes iconv to write beyond the bounds of the allocated buffer, corrupting adjacent heap objects. If the overflow can be controlled, the attacker may gain arbitrary code execution or trigger a denial‑of‑service by causing the affected application to crash.

The flaw resides in the FreeBSD operating system’s core C library iconv implementation. Any FreeBSD installation that has not installed the security update referenced in the advisory remains vulnerable whenever an application invokes iconv with one of the affected encodings. No specific product versions are listed, so all current releases that include the vulnerable code are potentially affected.

The EPSS score is reported as less than 1 %, and the vulnerability is not cataloged in CISA’s KEV list, suggesting that widespread exploitation is currently uncommon. Nonetheless, the typical attack path involves an adversary supplying poisoned input—either over a network to a service that uses iconv or locally to a program that processes untrusted files. Because the flaw is a classic heap buffer overflow (CWE‑122) and no patch is publicly available in the provided data, exploitability hinges on the presence of the affected encodings; disabling them or applying a vendor patch would eliminate the risk.