CVE-2026-57053 - Vulnerability Details - OpenCVE

GNU libidn before 1.44 is prone to out-of-bounds reads of uninitialized memory in the ToUnicode APIs because of mishandling in idna_to_unicode_internal. The affected code is not present in libidn2.

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Gnu	Libidn

No data.

No data.

No data.

References

Link	Providers
https://lists.gnu.org/archive/html/help-libidn/2026-05/msg00000.html
https://lists.gnu.org/archive/html/help-libidn/2026-06/msg00001.html

History

Tue, 23 Jun 2026 18:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Tue, 23 Jun 2026 17:30:00 +0000

Type	Values Removed	Values Added
Description		GNU libidn before 1.44 is prone to out-of-bounds reads of uninitialized memory in the ToUnicode APIs because of mishandling in idna_to_unicode_internal. The affected code is not present in libidn2.
First Time appeared		Gnu Gnu libidn
Weaknesses		CWE-1284
CPEs		cpe:2.3:a:gnu:libidn::::::::
Vendors & Products		Gnu Gnu libidn
References		https://lists.gnu.org/archive/html/help-libidn/2026-05/msg00000.html https://lists.gnu.org/archive/html/help-libidn/2026-06/msg00001.html
Metrics		cvssV3_1 `{'score': 4, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L'}`

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2026-06-23T16:40:22.947Z

Updated: 2026-06-23T17:40:14.173Z

Reserved: 2026-06-23T16:40:22.560Z

Link: CVE-2026-57053

Vulnrichment

Updated: 2026-06-23T17:40:10.988Z

NVD

No data.

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-57053", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "state": "PUBLISHED", "assignerShortName": "mitre", "dateReserved": "2026-06-23T16:40:22.560Z", "datePublished": "2026-06-23T16:40:22.947Z", "dateUpdated": "2026-06-23T17:40:14.173Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "libidn", "vendor": "GNU", "versions": [{"lessThan": "1.44", "status": "affected", "version": "0", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "GNU libidn before 1.44 is prone to out-of-bounds reads of\u00a0uninitialized memory in the ToUnicode APIs because of mishandling in\u00a0idna_to_unicode_internal. The affected code is not present in libidn2."}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 4, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-1284", "description": "CWE-1284 Improper Validation of Specified Quantity in Input", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-06-23T16:40:22.947Z"}, "references": [{"url": "https://lists.gnu.org/archive/html/help-libidn/2026-06/msg00001.html"}, {"url": "https://lists.gnu.org/archive/html/help-libidn/2026-05/msg00000.html"}], "x_generator": {"engine": "CVE-Request-form 0.0.1"}, "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:gnu:libidn:*:*:*:*:*:*:*:*", "versionEndExcluding": "1.44"}]}]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-23T17:40:08.293205Z", "id": "CVE-2026-57053", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-23T17:40:14.173Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-57053", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "state": "PUBLISHED", "assignerShortName": "mitre", "dateReserved": "2026-06-23T16:40:22.560Z", "datePublished": "2026-06-23T16:40:22.947Z", "dateUpdated": "2026-06-23T17:40:14.173Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "libidn", "vendor": "GNU", "versions": [{"lessThan": "1.44", "status": "affected", "version": "0", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "GNU libidn before 1.44 is prone to out-of-bounds reads of\u00a0uninitialized memory in the ToUnicode APIs because of mishandling in\u00a0idna_to_unicode_internal. The affected code is not present in libidn2."}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 4, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-1284", "description": "CWE-1284 Improper Validation of Specified Quantity in Input", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-06-23T16:40:22.947Z"}, "references": [{"url": "https://lists.gnu.org/archive/html/help-libidn/2026-06/msg00001.html"}, {"url": "https://lists.gnu.org/archive/html/help-libidn/2026-05/msg00000.html"}], "x_generator": {"engine": "CVE-Request-form 0.0.1"}, "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:gnu:libidn:*:*:*:*:*:*:*:*", "versionEndExcluding": "1.44"}]}]}]}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-57053", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-23T17:40:08.293205Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-23T17:40:10.988Z"}}]}}