A flaw in the glibc library’s SHIFT_JISX0213 to UCS-4 conversion routine allows a remote attacker to supply specially crafted input that causes the conversion function to repeatedly emit the same buffered code point without consuming further bytes. This loop keeps the function busy, resulting in a denial of service for any application that processes untrusted text. The weakness is a classic infinite loop bug, identified as CWE‑835.

The vulnerability affects all systems that rely on glibc for handling SHIFT_JISX0213 text conversion. No specific glibc version numbers are cited in the advisory, so any build using the affected conversion routine is potentially exposed, including Linux distributions and other Unix‑like operating systems that ship the standard glibc libraries.

The CVSS score of 5.9 indicates medium severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, suggesting that widespread, targeted exploitation has not been observed. The likely attack vector is remote: an attacker supplies malicious text to an application that calls glibc’s conversion routine, triggering the infinite retry churn and exhausting the target’s resources. The attack requires only that the vulnerable conversion function be invoked with malicious input; no further privileges or complex setup are described.