CVE-2026-57053 is a vulnerability in GNU libidn prior to version 1.44 involving improper validation of specified quantity in input (CWE-1284). Specifically, the ToUnicode APIs mishandle input in the idna_to_unicode_internal function, resulting in out-of-bounds reads of uninitialized memory. This vulnerability is not present in libidn2. The CVSS 3.1 base score is 4.0, reflecting a medium severity with local attack vector, high attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, low integrity impact, and low availability impact. No known exploits are reported, and no official patch or remediation level has been disclosed.

The vulnerability allows an attacker with local access and high attack complexity to cause out-of-bounds reads of uninitialized memory via the ToUnicode APIs. This may lead to low integrity and availability impacts. There is no confidentiality impact. The vulnerability does not affect libidn2. No known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, avoid using vulnerable versions of GNU libidn prior to 1.44 in security-critical contexts. Consider upgrading to libidn2, which is not affected by this vulnerability.