Converting a crafted EUC_JISX0213 sequence to UCS‑4 using glibc’s iconv or equivalent APIs can cause the converter to stall, repeatedly emitting a pending character without consuming input. The failure to make progress results in data conversion that never completes, causing the calling application to hang. This denial of service arises from a plain non‑progress failure (CWE‑835).

The vulnerability exists in the GNU C Library versions 2.3 through 2.44 whenever the EUC_JISX0213 charset is used. Any application that links against these glibc releases and performs text conversion with iconv or a similar API is potentially affected. The charset is uncommon, so exposure is limited to systems.

The CVSS base score of 5.9 indicates moderate severity, and the EPSS score of less than 1 percent shows a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. An attacker who can supply controlled EUC_JISX0213 input and can influence an application to use a small output buffer and to retry the conversion after an E2BIG error can force the application into an infinite loop, effectively denying service. The attack requires only locally or remotely provided data, with no additional privileges or authentication needed.