A stack buffer overflow occurs in the ISO‑2022 encoding module of FreeBSD’s iconv(3). The module allocates a 6‑byte buffer, yet some ISO‑2022 variants can require up to 10 bytes per character, allowing an overflow of up to four bytes. When an application passes untrusted input through iconv(3) to or from these affected encodings, the overflow can overwrite return addresses or other critical stack data, potentially enabling arbitrary code execution in the context of the converting process. This flaw is catalogued as CWE‑121.

FreeBSD operating systems that include the legacy iconv(3) implementation with the ISO‑2022 encoding module are affected. The advisory does not specify exact version ranges, so any installation that has not applied the recent patch or upgrade is potentially vulnerable. Applications that invoke iconv(3) to convert data from or to the affected ISO‑2022 variants are also at risk.

The EPSS score is below 1 % and the vulnerability is not listed in CISA’s KEV catalog, indicating a very low probability of current exploitation. The CVSS score of 9.8 classifies this vulnerability as critical. Exploitation requires that an attacker can supply crafted input to a program that uses iconv(3); if such a program runs with elevated privileges or exposes the conversion function over a network, the impact can range from local to remote code execution. No public exploit has been reported, and the advisory does not mention any active exploits.