{"id":"CVE-2026-84243","kind":"vulnerability","aliases":["CVE-2026-84243"],"related":[],"title":"glibc gettext: LANGUAGE variable lets a program load attacker-chosen message catalogs","description":"The gettext family of functions in the GNU C Library version 2.0 and later accept LANGUAGE environment variable entries that contain '/' or that are equal to \"..\", unless the program is setuid or setgid (AT_SECURE).  An attacker who can set LANGUAGE in the environment of a program that uses gettext can make it load a message catalog (.mo file) from an arbitrary location in the file system.  A crafted .mo file can crash the program through out-of-range offsets, or supply translations whose format directives do not match the arguments passed by the program.  That causes undefined behaviour in the printf family of functions and may allow arbitrary code execution with the privileges of the program.  The safety of message catalogs relies on them being installed in trusted, read-only locations, and the directory traversal bypasses this.\n\nThe fix for CVE-2014-0475 rejects \"..\" path components in locale names passed to setlocale or taken from the LC_ALL, LC_* and LANG environment variables.  gettext reads LANGUAGE directly and appends each colon-separated entry to the message catalog directory, so that fix did not cover LANGUAGE.\n\nLANGUAGE is only used when the LC_MESSAGES locale is not \"C\", \"C.<encoding>\" or \"POSIX\", so the attacker must also be able to select another installed locale, for example through LANG or LC_ALL.  Exploitation also requires that the attacker can place the crafted file in a location readable by the target program, and that the environment crosses a trust boundary without the program running as AT_SECURE.  An example is an SSH server that accepts LANGUAGE and LANG from clients through the AcceptEnv directive and restricts an account to a forced command; the attacker may use this to escape the restriction.","summary":"glibc's gettext functions accept LANGUAGE entries containing '/' or equal to '..' (only blocked for setuid/setgid programs). Anyone who can set LANGUAGE for a program can make it load a crafted .mo catalog from an arbitrary path. A bad catalog can crash the program or supply format strings that consume extra arguments, which is undefined behaviour in printf. Upstream patch targets glibc 2.45.","severity":"high","cvss":7.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"glibc","fixed":[],"affected":">= 2.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["gettext","glibc","linux","runtime","self-hosted","sshd"],"not_affected_if":["c-or-posix-locale-only","no-attacker-controlled-environment","no-untrusted-environment","setuid-or-setgid-programs","static-binary-no-gettext"],"how_to_check":"Run 'ldd --version' for the glibc version; every glibc from 2.0 on is affected until the patch ships. Then look for ways an attacker can set LANGUAGE for a gettext-using program: 'grep -i AcceptEnv /etc/ssh/sshd_config /etc/ssh/sshd_config.d/*' (Debian/Ubuntu defaults accept LANG and LC_*; check for LANGUAGE), plus CGI or services that pass request data into the environment.","fix":"Not yet in a released glibc as far as I could read. The upstream patch (bug 17142) rejects LANGUAGE entries containing '/' or equal to '..' for all programs, targeting glibc 2.45. Until your distro ships it, apply the mitigations. Check your distro's glibc security updates.","status":"open","published_at":"2026-10-30T18:18:13+00:00","first_seen_at":"2026-10-30T18:55:30+00:00","triaged_at":"2026-10-30T18:56:57+00:00","updated_at":"2026-10-30T18:57:54+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-10-30T18:56:57Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"glibc gettext: LANGUAGE variable lets a program load attacker-chosen message catalogs","impact":"high","summary":"The GNU C Library's gettext functions accept LANGUAGE entries containing slashes or '..', so a program can be made to load a message catalog from an arbitrary path. A crafted catalog can crash the program or supply mismatched format strings, which may allow code execution with the program's privileges.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["glibc","linux","gettext","sshd"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker runs code with the privileges of a vulnerable program","analyst_note":"Sources list no affected or fixed glibc versions and no advisory link; check the glibc project security announcements for the fixed release.","how_to_check":"- `ldd --version` to find the installed glibc version\n- Check whether programs on the host read LANGUAGE from the environment, for example via sshd with AcceptEnv LANGUAGE or LANG\n- unknown for the exact affected version ranges, as the sources given do not list them","plain_action":"","needs_analyst":true,"not_affected_if":["setuid-or-setgid-programs","c-or-posix-locale-only","no-untrusted-environment"],"who_is_affected":"Programs that use gettext for translated messages and receive a LANGUAGE value from an untrusted environment, such as an SSH server with AcceptEnv forwarding LANGUAGE and a non-C locale set by the attacker. Setuid and setgid programs are not affected because the library ignores these values for them. unknown for the full list of affected applications.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000773,"input_tokens":4593,"output_tokens":628,"severity_before":"high"},"analyst_status":"done","analyst_note":"Sources list no affected or fixed glibc versions and no advisory link; check the glibc project security announcements for the fixed release.","search":"'-0475':236C '-2014':235C '-2026':15A,18A '-84243':16A,19A '2.0':102C '2.45':90B 'abl':301C 'accept':33B,105C,355C 'acceptenv':363C 'account':368C 'allow':199C 'also':299C,315C 'anoth':304C 'anyon':45B 'append':262C 'arbitrari':63B,152C,200C 'argument':79B,182C 'attack':10A,127C,297C,319C,374C 'attacker-chosen':9A 'bad':66B 'behaviour':83B,190C 'block':41B 'boundari':340C 'bypass':229C 'c':99C,291C,292C 'catalog':13A,60B,67B,147C,213C,271C 'caus':188C 'chosen':11A 'client':360C 'code':201C 'colon':265C 'colon-separ':264C 'command':372C 'compon':239C 'consum':77B 'contain':36B,111C 'cover':278C 'craft':58B,159C,323C 'crash':69B,163C 'cross':337C 'cve':14A,17A,234C 'direct':177C,260C,364C 'directori':227C,272C 'entri':35B,109C,267C 'environ':107C,134C,255C,336C 'equal':38B,115C 'escap':379C 'exampl':308C,349C 'execut':202C 'exploit':314C 'extra':78B 'famili':93C,194C 'file':149C,156C,161C,324C 'fix':232C,275C 'forc':371C 'format':74B,176C 'function':32B,95C,196C 'gettext':2A,21B,31B,92C,140C,257C 'glibc':1A,20A,22B,29B,89B 'gnu':98C 'host':27B 'instal':218C,305C 'lang':254C,310C,358C 'languag':3A,34B,49B,106C,131C,259C,279C,280C,356C 'later':104C 'lc':250C,252C,286C,312C 'let':5A 'librari':100C 'linux':23B 'load':8A,56B,144C 'local':241C,288C,306C 'locat':153C,224C,327C 'make':54B,142C 'match':180C 'may':198C,375C 'messag':12A,146C,212C,270C,287C 'mo':59B,148C,160C 'must':298C 'name':242C 'offset':171C 'out-of-rang':167C 'pass':183C,243C 'patch':87B 'path':64B,238C 'place':321C 'posix':294C 'printf':85B,193C 'privileg':205C 'program':7A,44B,52B,71B,119C,137C,165C,186C,208C,332C,343C 'rang':170C 'read':222C,258C 'read-on':221C 'readabl':328C 'reject':237C 'reli':214C 'requir':316C 'restrict':366C,381C 'run':344C 'runtim':24B 'safeti':210C 'secur':125C,347C 'select':303C 'self':26B 'self-host':25B 'separ':266C 'server':353C 'set':48B,130C 'setgid':123C 'setlocal':245C 'setuid':121C 'setuid/setgid':43B 'ssh':352C 'sshd':28B 'string':75B 'suppli':73B,173C 'system':157C 'taken':247C 'target':88B,331C 'translat':174C 'travers':228C 'trust':220C,339C 'undefin':82B,189C 'unless':117C 'upstream':86B 'use':139C,283C,376C 'variabl':4A,108C,256C 'version':101C 'whose':175C 'without':341C","nicknames":[],"mitigations":[],"who_affected":"Programs that use gettext for translated messages and receive a LANGUAGE value from an untrusted environment, such as an SSH server with AcceptEnv forwarding LANGUAGE and a non-C locale set by the attacker. Setuid and setgid programs are not affected because the library ignores these values for them. unknown for the full list of affected applications.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T18:18:13+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"3ff69d7a-14f2-4f67-a097-88dee7810d18","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-84243","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84243","severity":null,"published_at":"2026-10-30T18:18:13+00:00","modified_at":"2026-10-30T18:18:13+00:00","first_seen_at":"2026-10-30T18:55:30+00:00","fetched_at":"2026-10-30T18:55:30+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-84243:1182","url":null,"severity":null,"published_at":"2026-10-30T18:57:54+00:00","modified_at":"2026-10-30T18:57:54+00:00","first_seen_at":"2026-10-30T18:57:54+00:00","fetched_at":"2026-10-30T18:57:54+00:00","note":"Read glibc patch v7/v5 on mailing lists and bug 17142. Fix is a patch in glibc master targeting 2.45 (NEWS entry); a mirror mentions commit e622f82ea8 for some glibc advisory but I could not confirm it is this one, and found no glibc release or GLIBC-SA page naming a fixed version. No exploitation or PoC found. Nothing verified."}],"documents":[{"id":25338,"url":"https://lists.endsoftwarepatents.org/archive/html/bug-gettext/2026-10/msg00014.html","title":"[PATCH v7] intl: Restrict path traversal when using LANGUAGE env var (CVE-2026-84243)","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":25339,"url":"https://sourceware.org/pipermail/libc-alpha/2026-September/180249.html","title":"[PATCH v5] intl: Restrict path traversal when using LANGUAGE env var (libc-alpha)","kind":"issue","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":25340,"url":"https://sourceware.org/legacy-ml/glibc-bugs/2014-07/msg00600.html","title":"glibc Bug 17142: LANGUAGE environment variable processing and directory traversal","kind":"issue","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}