CVE-2021-43396
In iconvdata/iso-2022-jp-3.c in the GNU C Library (aka glibc) 2.34, remote attackers can force iconv() to emit a spurious '\0' character via crafted ISO-2022-JP-3 data…
Published Nov 4, 2021 · updated Oct 14, 2026 · gnu glibc
In iconvdata/iso-2022-jp-3.c in the GNU C Library (aka glibc) 2.34, remote attackers can force iconv() to emit a spurious '\0' character via crafted ISO-2022-JP-3 data that is accompanied by an internal state reset. This may affect data integrity in certain iconv() use cases. NOTE: the vendor states "the bug cannot be invoked through user input and requires iconv to be invoked with a NULL inbuf, which ought to require a separate application bug to do so unintentionally. Hence there's no security impact to the bug.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
Nov 4, 2021 · NIST NVD
Detected
In iconvdata/iso-2022-jp-3.c in the GNU C Library (aka glibc) 2.34, remote attackers can force iconv() to emit a spurious '\0' character via crafted ISO-2022-JP-3 data that is accompanied by an internal state reset. This may affect data integrity in certain iconv() use cases. NOTE: the vendor states "the bug cannot be invoked through user input and requires iconv to be invoked with a NULL inbuf, w
Oct 14, 2026 · NIST NVD
Updated
In iconvdata/iso-2022-jp-3.c in the GNU C Library (aka glibc) 2.34, remote attackers can force iconv() to emit a spurious '\0' character via crafted ISO-2022-JP-3 data that is accompanied by an internal state reset. This may affect data integrity in certain iconv() use cases. NOTE: the vendor states "the bug cannot be invoked through user input and requires iconv to be invoked with a NULL inbuf, w
Affected
- cpe gnu/glibc2.34
- cpe oracle/communications cloud native core binding support function22.1.3
- cpe oracle/communications cloud native core network function cloud native environment22.1.0
- cpe oracle/communications cloud native core network repository function22.1.2
- cpe oracle/communications cloud native core network repository function22.2.0
- cpe oracle/communications cloud native core security edge protection proxy22.1.1
- cpe oracle/communications cloud native core unified data repository22.2.0
- cpe oracle/enterprise operations monitor4.3
Sources
- CVE.orgVulnerability recordCVE-2021-43396
Official CVE identifier
cve.org - FIRST EPSSExploitation probabilityCVE-2021-43396
30-day exploitation probability 3.3%
first.org - NIST NVDVulnerability recordCVE-2021-43396
In iconvdata/iso-2022-jp-3.c in the GNU C Library (aka glibc) 2.34, remote attackers can force iconv() to emit a spurious '\0' character via crafted ISO-2022-JP-3 data that is accompanied by an internal state reset. This may affect data integrity in certain iconv() use cases. NOT
nvd.nist.gov