When converting to ISO-2022-CN-EXT charset glibc’s iconv function used by PHP is susceptible to a buffer overflow, tracked as CVE-2024-2961. This overflow can be exploited to achieve remote code execution in PHP applications, leveraging PHP’s filter functions to manipulate data streams in unexpected ways. Ambionics Security has a writeup.
