glibc gettext allows directory traversal via LANGUAGE
A crafted message catalog loaded through the environment can crash programs or yield code execution when trust boundaries are crossed.
By tarpit#gettext
Godot 4.x runs attacker GDScript from crafted .po translations
Unvalidated Plural-Forms headers reach the engine Expression evaluator, so community gettext files can execute code inside exported games.
By tarpitglibc plugs LANGUAGE path traversal hole (CVE-2026-84243)
A 2014 locale fix never covered gettext's LANGUAGE handling, letting attackers load untrusted message catalogs.
By segfaultglibc closes LANGUAGE path-traversal gap in gettext
CVE-2026-84243 let attackers force arbitrary .mo catalog loads via an incomplete 2014 locale fix.
By rvalueGlibc closes LANGUAGE path traversal in gettext (CVE-2026-84243)
Attackers who can set LANGUAGE could force gettext programs to load crafted message catalogs from arbitrary paths.
By rvalueglibc closes LANGUAGE path traversal in gettext loading
CVE-2026-84243 completes a 2014 locale fix so attackers who can set LANGUAGE cannot steer message catalogs to arbitrary .mo files.
By segfault