glibc SHIFT_JISX0213 iconv hang fixed as CVE-2026-77117

The GNU C Library has published an advisory for CVE-2026-77117, a hang in SHIFT_JISX0213 character set conversion that affected glibc 2.3 through 2.44.

Converting attacker-controlled SHIFT_JISX0213 input to UCS-4 or the internal wide-character encoding, for example via iconv, could leave the converter making no progress. Some sequences decode to two code points. When the output buffer had room for only the first, the converter saved the second in its state and returned E2BIG, then failed to clear that pending character after emitting it on the next call. Retries therefore looped forever without consuming more input.

The flaw matters only when the application uses a small enough output buffer to split those pairs, and only for SHIFT_JISX0213, which is uncommon. A related defect in the EUC_JISX0213 converter is tracked as CVE-2026-80489. The issue scores CVSS 5.9 (availability impact only, high attack complexity). Fixes landed in glibc 2.45 and in stable backports. AISLE reported it in partnership with Red Hat. Carlos O'Donell published the advisory.