Zero Radar
← feed
HighVulnerabilityCVE-2026-84243updated 30 Oct 2026, 18:55 UTC

GNU C Library gettext can load message files from unsafe paths via LANGUAGE variable

Programs that show translated text can be tricked into loading a translation file from a folder chosen by an attacker. A crafted file can crash the program or run attacker code with the program's permissions.

Official, 3 sources
SeverityHighCVSS 7 of 10
Being exploited?UnclearNo reports either way yet
Fix available?UnclearNo fixed version published in the sources yet
How sure is this?Official, 3 sourcesBacked by an official source

How the attack works simplified

  1. 1Attacker sets envSets LANGUAGE with '..' path and LANG
  2. 2Program runsProgram using gettext starts in that environment
  3. 3Loads .mo filegettext reads catalog from traversed path
  4. 4Malicious catalogBad offsets or format strings in the file
  5. ResultProgram crashes or attacker runs code

What happened

The gettext functions in glibc 2.0 and later accept LANGUAGE environment entries containing '/' or '..', allowing directory traversal to arbitrary .mo message catalog files, unless the program runs setuid/setgid (AT_SECURE). A crafted catalog can cause out-of-range reads or mismatched printf format directives, leading to undefined behaviour.

Why it is dangerous: A crafted translation file can crash the program or may allow arbitrary code execution with the program's privileges. Programs whose environment crosses a trust boundary, such as SSH servers accepting LANGUAGE and LANG via AcceptEnv with restricted or forced-command accounts, can have those restrictions escaped.

Are you affected?

You are affected if you run a program linked against GNU C Library (glibc) 2.0 or later that uses gettext, and an attacker can set LANGUAGE and select another installed locale (via LANG or LC_ALL) in its environment, for example through SSH AcceptEnv.

GNU C Library (glibc) version 2.0 and later, programs using gettext that are not setuid/setgid.

What to do

  1. Check your glibc version and apply the vendor security update for GLIBC-SA-2026-0025 as soon as your distribution releases it
  2. Restrict which environment variables SSH AcceptEnv forwards, especially LANGUAGE, LANG and LC_ALL, on servers with restricted accounts
  3. Keep message catalogs in trusted, read-only locations and avoid giving untrusted users control of the environment

Timeline

  1. 30 Oct 2026, 18:18 UTC
    Publicly disclosed
  2. 30 Oct 2026, 18:18 UTC
    Reported by NVD · NVD
  3. 30 Oct 2026, 18:19 UTC
    Picked up by Zero Radar
  4. 30 Oct 2026, 18:45 UTC
    oss-security reported on it · oss-security
  5. 30 Oct 2026, 18:55 UTC
    GitHub Advisory reported on it · GitHub Advisory

Sources 3 reports, oldest first

Official vendor, government CERT or advisory database

Security researchers research teams and mailing lists

Technical details

ID
CVE-2026-84243 · GHSA-8rvm-662m-jvqv
CVSS
7 / 10
EPSS
0.3% chance of exploitation within 30 days
Disclosed
30 Oct 2026, 18:18 UTC
On Zero Radar
30 Oct 2026, 18:19 UTC (1 min after disclosure)
Last change
30 Oct 2026, 18:55 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

GNU C Library gettext can load message files from unsafe paths via LANGUAGE variable · Zero Radar