glibc gettext allows directory traversal via LANGUAGE

The GNU C Library has issued GLIBC-SA-2026-0025 for a directory traversal flaw in gettext that can lead to crashes or arbitrary code execution.

CVE-2026-84243 affects glibc 2.0 and later. The gettext family accepts LANGUAGE environment entries that contain '/' or equal '..' unless the program is setuid or setgid. An attacker who can set LANGUAGE for a program that uses gettext can force it to load a message catalog from an arbitrary filesystem path. A crafted catalog can crash the process through bad offsets, or supply translations whose format directives do not match the program's arguments, producing undefined behaviour in the printf family and potentially code execution at the program's privilege level.

Message catalogs are assumed to come from trusted, read-only locations; the traversal bypasses that. A prior fix for CVE-2014-0475 blocked '..' in locale names from setlocale and from LC_ALL, LC_*, and LANG, but gettext reads LANGUAGE directly and appends each colon-separated entry to the catalog directory, so that protection did not apply. LANGUAGE is used only when LC_MESSAGES is not C or POSIX, so the attacker must also choose another installed locale. The environment must cross a trust boundary without AT_SECURE, and the crafted file must be readable by the target. One example is an SSH server that accepts LANGUAGE and LANG through AcceptEnv for an account limited to a forced command.

Florian Weimer reported the issue.