Search threats, CVEs… ⌘K
← Back to CVE intelligence
CVE intelligence

CVE-2026-39821

Vulnerability intelligence

Published May 22, 2026Sources checked Nov 11, 2026
9.6CRITICALCVSS out of 10
What this means

Review the available evidence

CVE-2026-39821 and is rated Critical severity with a CVSS score of 9.6. It is not in the current CISA KEV record we collected. That does not prove exploitation has not occurred.

What to do next

Remediation and response

Microsoft Security Response Center guidance

Vendor revision: Oct 31, 2026
Vendor remediation details

CBL-Mariner Releases Release Notes

Vendor-listed releases

  • 1.7.7-4
  • 10.25.1-5
  • 1.3.0-2
  • 1.12.15-8
  • 8.7.11-6
  • 0.5.1-4
  • 2.1.6-3
  • 1.62.0-5
  • 1.11.4-17
  • 1.32.0-6
  • 0.14.0-13
  • 25.0.7-3
  • 2.27.0-11
  • 3.5.30-2
  • 0.24.2-28
  • 2.62.0-16
  • 3.6.1-3
  • 2.22.0-3
  • 2.7.5-17
  • 3.10.182-4
  • 3.19.1.kata3-3
  • 3.15.0.aks0-11
  • 2.14.1-13
  • 0.0.10-6
  • 1.30.10-25
  • 1.7.1-5
  • 1.15.0-5
  • 1.7.7-13
  • 25.0.3-18
  • 4.0.2-8
  • 0.63.0-4
  • 1.9.5-14
  • 0.12.0-6
  • 1.7.0-4
  • 0.8.2-4
  • 1.14.4-11
  • 3.7.0-6
  • 1.31.0-21
  • 19.0.4-10
  • 1.25.11-2
  • 1.26.4-2
CISA KEVNot listedBased on the latest collected catalog
EPSS1.8%Estimated 30-day exploitation probability
Ransomware useNot markedCISA KEV ransomware field
Threat actors0Source-linked actor relationships
Overview

What is CVE-2026-39821?

The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error.

This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject "example.com" but permit "xn--example-.com".

If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name "example.com".

Source: NVD