A flaw in the GB18030 four‑byte decoder of musl libc allows local attackers to craft data that causes the iconv routine to exhibit excessive algorithmic complexity. The result is a practical denial‑of‑service condition, as processing the data consumes disproportionate CPU time. The weakness is aligned with CWE‑1050 (Infinite Recursion), CWE‑404 (Improper Handling of File Paths), and CWE‑407 (Inefficient Algorithm).

The vulnerability exists in musl libc versions up to 1.2.6 and impacts the "iconv" function in the GB18030 decoder component. It affects systems that compile or link against this version of musl, which includes many Linux distributions and embedded platforms relying on musl as the standard C library.

The CVSS score of 4.8 indicates moderate severity, but the EPSS score below 1% and the lack of listing in the CISA KEV catalog suggest that exploitation is unlikely at present. Nevertheless, the problem requires local execution privileges, so any untrusted local user or compromised local process could trigger resource exhaustion. The risk is therefore primarily to availability rather than confidentiality or integrity.