CVE-2026-77117 The GNU C Library CVE debrief

Who should care

Defenders responsible for systems using GNU C Library versions 2.3 to 2.44, especially those handling character encoding, should assess exposure and prioritize patching. This includes operators, platform administrators, vulnerability management teams, and security teams. They should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.

Why it matters

A denial-of-service vulnerability exists in GNU C Library versions 2.3 to 2.44, allowing attackers to cause hangs in applications using the library for character encoding conversion.

• Potential denial-of-service attacks on systems using affected GNU C Library versions
• Need to verify and patch affected systems to prevent potential hangs
• Possible impact on applications that handle character encoding

Technical summary

The vulnerability exists in the GNU C Library's handling of SHIFT_JISX0213 input. An attacker can cause a hang by providing crafted input that splits two code points in the output buffer. The converter stores the second code point in the conversion state and returns E2BIG, but it never clears that pending character after emitting it on the next call. This requires the input to be attacker-controlled and the application to have a small enough output buffer to split the two code points. The related defect in the EUC_JISX0213 converter is tracked separately as CVE-2026-80489.

Defensive priority

Defenders should prioritize verifying and patching affected systems, especially those handling character encoding.

Recommended defensive actions

• Verify and apply patches for GNU C Library versions 2.3 to 2.44
• Review and update applications that handle character encoding
• Monitor systems for potential denial-of-service attacks
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability is caused by the converter not clearing a pending character after emitting it, leading to an infinite loop. This requires the input to be attacker-controlled and the application to have a small enough output buffer. The related defect in the EUC_JISX0213 converter is tracked separately as CVE-2026-80489. The SHIFT_JISX0213 character set is not commonly used, limiting the potential impact. Defenders should verify and patch affected systems, especially those handling character encoding.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.