CVE-2016-6263: GNU Libidn

High severity, CVSS 7.5. EPSS: 3.9% chance of exploitation in the next 30 days.

The stringprep_utf8_nfkc_normalize function in lib/nfkc.c in libidn before 1.33 allows context-dependent attackers to cause a denial of service (out-of-bounds read and crash) via crafted UTF-8 data.

Affected products

• GNU Libidn: up to and including 1.32

Published 2016-09-07. Last modified 2026-06-17.