A stack buffer overflow occurs in the ISO-2022 encoding module of FreeBSD's iconv(3). The module allocates a 6‑byte buffer, but some ISO‑2022 variants need up to 10 bytes per character, allowing an overflow of up to four bytes. Because the overflow happens while converting untrusted input, a malicious user can overwrite the return address or other critical stack data, potentially enabling arbitrary code execution in the context of the process that performs the conversion. This is a classic stack buffer overflow vulnerability (CWE‑121).

FreeBSD operating systems that include the affected iconv(3) implementation. The vulnerability is present in the ISO‑2022 encoding module. Specific version ranges are not listed in the advisory, so any installation that has not applied the recent patch or upgrade is potentially affected. Applications that invoke iconv(3) to convert data from or to the affected ISO‑2022 variants are also at risk.

The EPSS score is below 1 % and the vulnerability is not listed in CISA’s KEV catalog, indicating a very low probability of current exploitation. Exploitation requires that an attacker can supply crafted input to a program that uses the affected iconv module. If the application runs with elevated privileges or exposes the conversion function over a network, the impact grows from local to remote code execution. The advisory does not mention any public exploit.