---
id: CVE-2026-122054
title: BIG-HKSCS decoding hang on crafted input
summary: >-
  Converting crafted BIG-HKSCS input to UCS-4 or the internal wide character
  encoding, for example with iconv, in the GNU C Library version 2.18 through
  2.31 may result in the converter making no progress, causing the calling
  application t…
severity: medium
cvss: 5.9
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'
cvssSource: cna
cwe:
  - CWE-835
vendor: The GNU C Library
product: glibc
affected:
  - glibc >= 2.18 <= 2.31
published: '2026-11-04'
updated: '2026-11-04'
sourceUpdated: '2026-11-04T19:04:35.774Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-122054'
references:
  - url: 'https://sourceware.org/bugzilla/show_bug.cgi?id=25734'
  - url: >-
      https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0026
tags:
  - cve.org
ingestedAt: '2026-11-05T21:36:00.518Z'
epss: 0.00446
epssPercentile: 0.39051
---

## Overview

Converting crafted BIG-HKSCS input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.18 through 2.31 may result in the converter making no progress, causing the calling application to hang.

## Affected

- `glibc >= 2.18 <= 2.31`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.