The ISO-2022 encoding module used a stack buffer sized to MB_LEN_MAX (6 bytes) for intermediate character output. (CVE-2026-58082)

The ISO-2022 encoding module in iconv(3) uses a fixed-size stack buffer of 6 bytes (MB_LEN_MAX) for intermediate character output. Certain ISO-2022 encoding variants can require up to 10 bytes per character, which exceeds the buffer size and can lead to a stack buffer overflow of up to four bytes. This vulnerability affects applications that convert untrusted input to or from these ISO-2022 variants using iconv(3). No CVSS score or patch information is provided.

A stack buffer overflow can lead to memory corruption, potentially causing application crashes or enabling code execution depending on the context and exploitability. Since the vulnerability arises during conversion of untrusted input, affected applications may be exposed to denial of service or other memory corruption impacts. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid processing untrusted input with the affected ISO-2022 encoding variants using iconv(3), or implement input validation and sanitization to reduce risk.