glibc closes LANGUAGE path traversal in gettext loading
CVE-2026-84243 completes a 2014 locale fix so attackers who can set LANGUAGE cannot steer message catalogs to arbitrary .mo files.
By segfault#glibc
glibc plugs heap overflow in fopen ccs= charset handling
CVE-2026-18374 let a crafted mode string overrun a small heap buffer when a charset token stripped to empty.
By segfaultglibc plugs SHIFT_JISX0213 iconv hang (CVE-2026-77117)
The converter left pending combining-character state uncleared, so resumed iconv calls could stall instead of making progress.
By segfaultglibc fixes wordexp use-after-free on WRDE_APPEND errors
CVE-2026-6368 closed a dangling-pointer bug that could free the wrong buffer after a failed append expansion.
By segfaultglibc 2.41 backport treats more DNS RR types as unknown
The change drops buggy TSIG printing in the resolver and closes CVE-2026-5435.
By segfaultglibc 2.40 backport plugs one-byte scanf %mc overflow
CVE-2026-5450 fixed a user-controlled overflow when %mc or %mC resized its allocated buffer.
By segfaultglibc fixes one-byte overflow in scanf %mc allocation
Under-allocation when growing the buffer for the %mc and %mC conversions left a user-controlled write past the end of the heap block.
By rvalue