CVE-2026-84243

Name of the Vulnerable Software and Affected Versions GNU C Library versions 2.0 and later

Description The gettext family of functions allows the LANGUAGE environment variable to contain entries with '/' or '..', provided the program is not running as setuid or setgid (AT SECURE). An attacker capable of controlling the LANGUAGE variable can force the program to load a message catalog (.mo file) from an arbitrary file system location. A specially crafted .mo file can cause the program to crash via out-of-range offsets or provide translations with format directives that mismatch the program arguments, leading to undefined behavior in the printf family of functions and potentially allowing arbitrary code execution with the program's privileges. This issue occurs because the directory traversal bypasses the requirement that message catalogs be stored in trusted, read-only locations. Exploitation requires the LC MESSAGES locale to be something other than "C", "C.", or "POSIX", and the attacker must be able to place the crafted file in a readable location.

Recommendations Update GNU C Library to a version that rejects ".." path components and '/' characters in the LANGUAGE environment variable.