CVE-2021-43396

In iconvdata/iso-2022-jp-3.c in the GNU C Library (aka glibc) 2.34, remote attackers can force iconv() to emit a spurious '\0' character via crafted ISO-2022-JP-3 data that is accompanied by an internal state reset. This may affect data integrity in certain iconv() use cases. NOTE: the vendor states "the bug cannot be invoked through user input and requires iconv to be invoked with a NULL inbuf, which ought to require a separate application bug to do so unintentionally. Hence there's no security impact to the bug.

• https://blog.tuxcare.com/vulnerability/vulnerability-in-iconv-identified-by-tuxcare-team-cve-2021-43396Exploit, Third Party Advisory
• https://sourceware.org/bugzilla/show_bug.cgi?id=28524Exploit, Issue Tracking, Third Party Advisory
• https://sourceware.org/git/?p=glibc.git%3Ba=commit%3Bh=ff012870b2c02a62598c04daa1e54632e020fd7d
• https://www.oracle.com/security-alerts/cpujul2022.htmlPatch, Third Party Advisory
• https://blog.tuxcare.com/vulnerability/vulnerability-in-iconv-identified-by-tuxcare-team-cve-2021-43396Exploit, Third Party Advisory
• https://sourceware.org/bugzilla/show_bug.cgi?id=28524Exploit, Issue Tracking, Third Party Advisory
• https://sourceware.org/git/?p=glibc.git%3Ba=commit%3Bh=ff012870b2c02a62598c04daa1e54632e020fd7d
• https://www.oracle.com/security-alerts/cpujul2022.htmlPatch, Third Party Advisory

Published

Nov 4, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-43390An Out-of-Bounds Write vulnerability exists when reading a D…7.8
• CVE-2021-43391An Out-of-Bounds Read vulnerability exists when reading a DX…7.8
• CVE-2021-43392STMicroelectronics STSAFE-J 1.1.4, J-SAFE3 1.2.5, and J-SIGN…6.2
• CVE-2021-43393STMicroelectronics STSAFE-J 1.1.4, J-SAFE3 1.2.5, and J-SIGN…6.2
• CVE-2021-43394Unisys OS 2200 Messaging Integration Services (NTSI) 7R3B IC…9.8
• CVE-2021-43395An issue was discovered in illumos before f859e7171bb5db3432…5.5
• CVE-2021-43397LiquidFiles before 3.6.3 allows remote attackers to elevate …8.8
• CVE-2021-43398Crypto++ (aka Cryptopp) 8.6.0 and earlier contains a timing …5.3
• CVE-2021-43399The Yubico YubiHSM YubiHSM2 library 2021.08, included in the…7.5
• CVE-2021-4340The uListing plugin for WordPress is vulnerable to generic S…7.5
• CVE-2021-43400An issue was discovered in gatt-database.c in BlueZ 5.61. A …9.1
• CVE-2021-43403An issue was discovered in FusionPBX before 4.5.30. The log_…6.5