CVE search · CVE-2026-57053

CVE-2026-57053

low 2.5

GNU libidn before 1.44 is prone to out-of-bounds reads of uninitialized memory in the ToUnicode APIs because of mishandling in idna_to_unicode_internal. The affected code is not present in libidn2.

Open in the NVD CVE.org JSON

Status: Analyzed
Published: 2026-06-23
Last changed: 2026-10-25
Source: cve@mitre.org
Weakness: CWE-1284

Severity

Version	Score	Vector	Source
CVSS 3.1	medium 4.0	`CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L`	cve@mitre.orgSecondary
CVSS 3.1	low 2.5	`CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N`	nvd@nist.govPrimary

Affected products

Vendor and product from the NVD’s CPE applicability statements. Versions and conditions are on the NVD’s page.

gnu · libidn

References

https://lists.gnu.org/archive/html/help-libidn/2026-05/msg00000.htmlExploitMailing List
https://lists.gnu.org/archive/html/help-libidn/2026-06/msg00001.htmlMailing List

CVE-2026-57053

Details

Severity

Affected products

References