CVE-2026-84243: What the glibc gettext Flaw Means for You

On Friday, 30 October 2026, Adhemerval Zanella Netto posted GLIBC-SA-2026-0025 to the oss-security list. The title is gettext: Directory traversal via the LANGUAGE environment variable, and the ID is CVE-2026-84243. The score in the note is 7.0. A value that chooses a program's language can point it at a translation file on a path you did not choose.

If your site, mail, or office tools run on the GNU C Library, you are in the audience I wrote this for. I can take this on with you through the Able Retainer, $799 a month for eight hours of senior production time, planned with you. Write me at greg@ableadmins.com.

What was published

gettext is the piece of the GNU C Library that loads translated text. The text ships in a message catalog, a .mo file. LANGUAGE is an environment variable, a short setting passed to a program when it starts. It lists the languages to try.

The advisory says gettext in glibc 2.0 and later accepts a LANGUAGE entry that contains a slash (/) or that equals "..", unless the program is setuid or setgid. The note calls that case AT_SECURE: a program marked setuid or setgid so it runs with a fixed extra privilege. A slash names a folder. ".." names the folder above. An attacker who can set LANGUAGE can make the program load a .mo file from an arbitrary filesystem location.

A crafted .mo file can crash the program through out-of-range offsets. It can also supply translations whose format directives do not match the program's arguments. Those directives are the markers that say where a name or a number goes. A mismatch, the advisory says, causes undefined behavior in the printf family, and possibly arbitrary code execution with the program's privileges.

Red Hat describes the same issue: a local attacker sets LANGUAGE across a trust boundary, loads a malicious translation file, leading to code execution or a crash. Red Hat tracks it as Bugzilla 2564231 and CWE-22, which is a path that escapes its directory. Red Hat and cve.org both show a base score of 7 with the vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. Read in plain words, that is local access, a difficult set of conditions, and a high impact on the system involved.

An older fix, CVE-2014-0475, rejects ".." in locale names passed to setlocale or taken from LC_ALL, LC_*, and LANG. gettext reads LANGUAGE directly, and the advisory says that fix did not cover it. LANGUAGE is used only when LC_MESSAGES is not "C", "C" plus an encoding, or "POSIX". Florian Weimer is the reporter. The note lists Public-Date 2014-07-11. The CVE assignment itself is the 30 October 2026 post.

The details above are enough to brief the person who runs your servers. If you want me to carry it from here, start with the Able Retainer.

What this means for your servers

Amazon Linux marks the CVE public on 30 October 2026 and modified on 2 November 2026, with severity Important and a score of 7.0. glibc on Amazon Linux 2, Amazon Linux 2023, and Amazon Linux 2027 Preview is listed as Pending Fix. If you run those releases, watch that page for the package and apply it in a window you choose. For a different Linux, ask your host how they are handling CVE-2026-84243 on the servers you have. The links at the end hold the full detail.

Two conditions have to be true. A crafted file has to be readable by the target, and the environment has to cross a trust boundary without AT_SECURE. The example is an SSH server that accepts LANGUAGE and LANG through AcceptEnv, for an account restricted to a forced command. AcceptEnv tells SSH to copy those settings from the person who logs in. A forced command keeps that account to one configured command. LANGUAGE can still be copied in, and it can aim that command at a .mo file the account is able to read.

A few quiet checks

Ask who looks after your Linux servers, and whether a glibc fix for CVE-2026-84243 is already in place. For Amazon Linux 2, Amazon Linux 2023, and Amazon Linux 2027 Preview, the status dated 2 November 2026 is Pending Fix.
Ask whether SSH accepts LANGUAGE or LANG from a login. The case in the advisory is AcceptEnv on an account restricted to a forced command.
Ask whether that account can read files beyond the ones its command uses. The advisory starts from a crafted .mo file the target can open.
When your vendor publishes the glibc update, add it to the maintenance window you already use.

If you want those answers gathered beside you, that is the work I do on the Able Retainer.

How Able can help

I am Greg Borbonus, and I do this work myself. On the retainer I sit with your server list, read GLIBC-SA-2026-0025 against the way those machines start programs, and check whether a login can pass LANGUAGE in. When your Linux vendor publishes the glibc package, I schedule it with you.

The Able Retainer is $799 a month for eight hours of senior production time, planned with you. Email greg@ableadmins.com or call (832) 977-1356 and tell me which servers you want looked at first.

Sources

When you want a calm person on this, I am glad to plan it with you on the Able Retainer. Write me at greg@ableadmins.com.