CVE-2016-10228: The iconv program in the GNU C Library (aka glibc or libc6) 2.31 and earlier, when invoked with multiple su...

Security readout for executives and security teams

CVE-2016-10228 can make the glibc iconv command hang indefinitely when processing malformed multibyte text under a specific option combination. The business impact is denial of service, mainly where automated systems convert untrusted files or streams. Exposure is most likely on Linux systems with affected glibc where scripts, services, upload workflows, or data pipelines invoke iconv on untrusted text. Systems not using the iconv command in this way have lower practical exposure. Prioritize patching where text conversion is exposed to user-supplied files or automated ingestion. For general servers, handle through normal OS security maintenance unless local workflows make iconv reachable by untrusted input. Mitigation focus: Update glibc/libc6 through the operating system vendor channel.; Review Gentoo, Debian, Oracle, or relevant distribution advisories for fixed package versions.; Avoid running iconv on untrusted input without timeouts or process limits..

Prepared

Jun 13, 2026, 06:02 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.