musl - denial-of-service issue in musl’s iconv implementation

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAD04+wiNBzw1wYqR3_u7yWCP==yGvj_Xsk8F8rxH0zUPhhFQDA@mail.gmail.com>
Date: Fri, 23 Jan 2026 10:17:51 -0500
From: Richard Howe <rhowe425@...il.com>
To: musl@...ts.openwall.com
Subject: denial-of-service issue in musl’s iconv implementation

Hello,

I am reporting a denial-of-service issue in musl’s iconv implementation.
Summary

A crafted input passed to iconv() can trigger an internal assertion failure
in gconv():

../iconv/skeleton.c:745: gconv: Assertion `outbuf == outerr' failed

This causes the process to abort, resulting in a denial of service.
Affected versions

Tested on musl 1.2.5 (x86_64).
I have not tested earlier versions.
Impact

This issue allows untrusted input to reliably crash processes using iconv().
The failure occurs via an internal invariant violation and results in
abort().

When musl is rebuilt with assertions disabled (-DNDEBUG), the same input no
longer crashes and does not appear to cause memory corruption, indicating
this is a DoS issue rather than an RCE.
Reproduction

The issue is reproducible using a simple harness that invokes iconv_open()
and iconv() on attacker‑controlled input.

Steps:

   1.

   Build musl normally (assertions enabled).
   2.

   Compile the attached harness against musl.
   3.

   Run the harness with the provided input file.

The process aborts with the assertion above.

I am happy to provide:

   -

   the minimal crashing input
   -

   the reproduction harness
   -

   additional debugging information if needed

Thank you for your time.

Best regards,
Richard Howe

[image: image.png]

Content of type "text/html" skipped

Download attachment "image.png" of type "image/png" (278470 bytes)

Download attachment "id:000000,sig:06,src:000041+000001,time:165387,execs:284094,op:havoc,rep:17" of type "application/octet-stream" (34 bytes)

View attachment "harness-debug.c" of type "text/x-csrc" (6377 bytes)

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.