CVE-2021-43396: GNU Glibc

High severity, CVSS 7.5. EPSS: 3.3% chance of exploitation in the next 30 days.

In iconvdata/iso-2022-jp-3.c in the GNU C Library (aka glibc) 2.34, remote attackers can force iconv() to emit a spurious '\0' character via crafted ISO-2022-JP-3 data that is accompanied by an internal state reset. This may affect data integrity in certain iconv() use cases. NOTE: the vendor states "the bug cannot be invoked through user input and requires iconv to be invoked with a NULL inbuf, which ought to require a separate application bug to do so unintentionally. Hence there's no security impact to the bug.

Affected products

• GNU Glibc: version 2.34 only
• Oracle Communications Cloud Native Core Binding Support Function: version 22.1.3 only
• Oracle Communications Cloud Native Core Network Function Cloud Native Environment: version 22.1.0 only
• Oracle Communications Cloud Native Core Network Repository Function: version 22.1.2 only; version 22.2.0 only
• Oracle Communications Cloud Native Core Security Edge Protection Proxy: version 22.1.1 only
• Oracle Communications Cloud Native Core Unified Data Repository: version 22.2.0 only
• Oracle Enterprise Operations Monitor: version 4.3 only; version 4.4 only; version 5.0 only

Published 2021-11-04. Last modified 2026-06-17.