Libidn Uninitialized Memory Read in ToUnicode Round-trip Validation

Vulnerability Overview A read of uninitialized memory issue exists in the ToUnicode round-trip verification within the Libidn library. Specifically, the function assumes that decoded ASCII labels begin with “xn--” during label decoding. However, this assumption does not hold when the decoded label consists entirely of ASCII characters, leading to the reading and comparison of uninitialized bytes at the end of . Affected Versions Affected versions: Libidn versions from June 7, 2003, to March 21, 2025, as well as the current git version (e65b5df). Potential risks: May lead to incorrect security decisions, such as those involving domain name validation, routing, cache identification, logging, or warning display. Attack scenarios: Attackers can exploit this vulnerability by providing specific hostnames or email addresses, affecting applications that rely on Libidn for domain name validation. Remediation The recommended fixes are: 1. Compare the complete original ACE result with the complete ToASCII result, rather than assuming the ToASCII result starts with “xn--”. 2. Employ stricter defensive checks, such as verifying that begins with before performing comparisons. Proof of Concept (POC) Code Additional Information Reporter: Jiani (OWASP) Report date: May 19, 2026 Attachments: A zip file containing the POC and README, along with a reproduction program using the public Libidn API. Summary This vulnerability involves the ToUnicode round-trip verification in the Libidn library and may result in the reading of uninitialized memory, thereby impacting security decisions. It is recommended to fix this issue by comparing the complete ACE and ToASCII results.

Goal Reached Thanks to every supporter — we hit 100%!

Libidn Uninitialized Memory Read in ToUnicode Round-trip Validation