Bug 2523274 (CVE-2026-77117)

Summary:	CVE-2026-77117 glibc: Non-progress DoS in SHIFT_JISX0213 -&gt
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	akhatavk, aos-team-art-private, asdas, ashankar, codonell, dj, dpaolell, fweimer, jdelft, jupierce, lgarciaa, mbiarnes, pfrankli, ppalepu, ppostler, prdhamdh, rhel-process-autobot, sghai, sidsharm, suppawar, vlaad, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in glibc. A remote attacker could exploit this vulnerability by providing specially crafted input during SHIFT_JISX0213 to UCS-4 text conversion. This crafted input can cause the application to repeatedly emit a buffered code point without consuming further input, leading to persistent retry churn. This can result in a denial of service (DoS) for callers converting untrusted text.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2523276, 2523277, 2523278
Bug Blocks:

Description OSIDB Bzimport 2026-08-25 08:38:16 UTC

Summary: Non-progress DoS in SHIFT_JISX0213 -&gt; UCS-4 conversion state  <br/>
handling (`iconvdata/shift_jisx0213.c`): crafted input can cause repeated  <br/>
emission of a buffered code point without further input consumption,  <br/>
leading to persistent retry churn and denial of service in callers  <br/>
converting untrusted text.<br/>
Requirements to exploit: An attacker must be able to supply text that an  <br/>
application converts from `SHIFT_JISX0213` to `UCS-4`, trigger a 2-byte  <br/>
sequence that expands through `__jisx0213_to_ucs_combining`, and have the  <br/>
caller retry after `E2BIG` with the same conversion state once only enough  <br/>
output space remains for the first of the two emitted code points.  <br/>
Applications that never use this conversion path, or that abort on repeated  <br/>
no-progress `E2BIG`, are not practically exposed.<br/>
Component affected: `glibc-2.42-11.1.hum1`; `iconvdata/shift_jisx0213.c`,  <br/>
`from_shift_jisx0213` (`BODY` macro) in the `SHIFT_JISX0213` -&gt; `UCS-4`  <br/>
conversion path.<br/>