CVE-2026-57053 is a medium severity vulnerability in GNU libidn's idna_to_unicode_internal() function, which mishandles the ToUnicode APIs by assuming the internal buffer always starts with the "xn--" ACE prefix. When decoding pure ASCII labels shorter than four characters, no prefix is added, causing the function to read past the buffer's null terminator into uninitialized stack memory. This out-of-bounds read can lead to silent acceptance and normalization of invalid ACE-encoded labels, potentially affecting domain-based security decisions such as allow/deny-list matching, hostname comparisons, routing, and logging. The flaw does not impact libidn2, which properly guards against this condition. The vulnerability is tracked under CWE-125 (Out-of-bounds Read).

The vulnerability can cause information disclosure by reading uninitialized stack memory, which may include sensitive data such as cryptographic keys or memory addresses. It can also lead to denial of service through application crashes caused by out-of-bounds memory reads. Additionally, the flaw may allow bypassing domain-based security mechanisms by normalizing invalid domain labels to different strings, potentially impacting security decisions in applications relying on these APIs.

No configuration-level mitigation is available because the vulnerability depends on uninitialized stack content, making behavior non-deterministic and input filtering ineffective. Users should update to a fixed version of the libidn package once it is released. Until a fix is available, applications processing untrusted internationalized domain names should treat the output of idna_to_unicode_8z8z()/idna_to_unicode_8zlz() as unverified, perform independent comparisons against the original ACE-encoded input, or switch to using libidn2 for IDNA processing, which is not affected by this vulnerability.