CVE-2026-84243

The gettext family of functions in the GNU C Library version 2.0 and later accept LANGUAGE environment variable entries that contain '/' or that are equal to "..", unless the program is setuid or setgid (AT_SECURE). An attacker who can set LANGUAGE in the environment of a program that uses gettext can make it load a message catalog (.mo file) from an arbitrary location in the file system. A crafted .mo file can crash the program through out-of-range offsets, or supply translations whose format directives do not match the arguments passed by the program. That causes undefined behaviour in the printf family of functions and may allow arbitrary code execution with the privileges of the program. The safety of message catalogs relies on them being installed in trusted, read-only locations, and the directory traversal bypasses this. The fix for CVE-2014-0475 rejects ".." path components in locale names passed to setlocale or taken from the LC_ALL, LC_* and LANG environment variables. gettext reads LANGUAGE directly and appends each colon-separated entry to the message catalog directory, so that fix did not cover LANGUAGE. LANGUAGE is only used when the LC_MESSAGES locale is not "C", "C.<encoding>" or "POSIX", so the attacker must also be able to select another installed locale, for example through LANG or LC_ALL. Exploitation also requires that the attacker can place the crafted file in a location readable by the target program, and that the environment crosses a trust boundary without the program running as AT_SECURE. An example is an SSH server that accepts LANGUAGE and LANG from clients through the AcceptEnv directive and restricts an account to a forced command; the attacker may use this to escape the restriction.

• CWE-22

• https://inbox.sourceware.org/libc-alpha/20261012112453.47383-1-avinal.xlvii@gmail.com
• https://sourceware.org/bugzilla/show_bug.cgi?id=17142
• https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0025

Published

Oct 30, 2026

Last Modified

Oct 31, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-84233A flaw was found in rpm. A local attacker could supply a spe…7
• CVE-2026-84235A denial-of-service security issue exists in the affected pr…8.7
• CVE-2026-84238Unauthenticated Broken Access Control in YITH Request a Quot…9.8
• CVE-2026-84239IBM Guardium Data Protection 12.2 could allow a remote authe…7.6
• CVE-2026-8424The Remove Yellow BGBOX plugin for WordPress is vulnerable t…4.3
• CVE-2026-84241IBM Guardium Data Protection 12.2 could allow a remote attac…8.1
• CVE-2026-84244IBM Guardium Data Protection 12.2 IBM Security Guardium Data…6.1
• CVE-2026-84245IBM Guardium Data Protection 12.2 is vulnerable to a local p…7.8
• CVE-2026-84246IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allo…9.8
• CVE-2026-84247IBM Guardium Data Protection 12.2 could allow a remote authe…6.5
• CVE-2026-84249IBM Guardium Data Protection 12.2, and 12.2.2 could allow a …9.8
• CVE-2026-8425The Notify Odoo plugin for WordPress is vulnerable to Cross-…4.3