Directory Traversal Vulnerability in GNU C Library

CVE-2026-84243

What is CVE-2026-84243?

A vulnerability exists in the gettext functions of GNU C Library, allowing an attacker to manipulate the LANGUAGE environment variable. By doing so, they can make the application load a message catalog from an untrusted location, potentially leading to crashes through out-of-range offsets or executing arbitrary code. This issue occurs when the program is not setuid or setgid, enabling unsafe interactions with message catalogs, which should only be retrieved from secure, read-only directories. Proper measures must be taken to ensure that programs do not accept untrusted locale settings.

References