Is CVE-2026-84243 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-84243 being exploited in the wild.

How severe is CVE-2026-84243?

High severity, with a CVSS score of 7, published 30 October 2026.

How is CVE-2026-84243 attacked?

It is attacked from the adjacent network or with local access, in a software library.

Am I affected by CVE-2026-84243?

Check whether you run Gnu C Library at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-84243: GNU C Library gettext directory traversal in LANGUAGE variable

CVE-2026-84243 · Severity: high · CVSS 7 · Published 2026-10-30

The GNU C Library's gettext functions fail to validate the LANGUAGE environment variable, allowing attackers to load message translation files from arbitrary locations on the filesystem. By crafting a malicious translation file and controlling environment variables, an attacker can crash programs or execute arbitrary code with the program's privileges, particularly in scenarios where environment inheritance crosses trust boundaries such as SSH forced command execution.

Technologies: Gnu C Library. Vendors: Gnu.

Quick answers

Is CVE-2026-84243 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-84243 being exploited in the wild.
How severe is CVE-2026-84243?: High severity, with a CVSS score of 7, published 30 October 2026.
Which products and versions are affected?: Gnu C Library 2.0 and later.
Is there a fix for CVE-2026-84243?: No fixed version is recorded yet. Restrict environment variable inheritance through SSH's AcceptEnv directive to exclude LANGUAGE and locale-related variables; alternatively, ensure programs that accept locale selection from untrusted sources are not setuid/setgid and run in contexts where AT_SECURE is enforced.</anigation> </invoke> If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-84243 attacked?: It is attacked from the adjacent network or with local access, in a software library.
Am I affected by CVE-2026-84243?: Check whether you run Gnu C Library at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Restrict environment variable inheritance through SSH's AcceptEnv directive to exclude LANGUAGE and locale-related variables; alternatively, ensure programs that accept locale selection from untrusted sources are not setuid/setgid and run in contexts where AT_SECURE is enforced.</anigation> </invoke>

Technical details

The gettext family of functions in glibc 2.0+ do not validate LANGUAGE environment variable entries for directory traversal (../) or absolute paths, allowing message catalog (.mo) files to be loaded from arbitrary locations. This bypasses the earlier CVE-2014-0475 fix which only covered LC_* and LANG variables. Exploitation requires the attacker to control environment variables (LANGUAGE and LC_MESSAGES) in a trust boundary context where the program is not running with AT_SECURE set, and ability to place a crafted .mo file in a readable location; successful exploitation causes undefined behavior in printf-family functions and potential arbitrary code execution.

Affected products

GNU C Library 2.0 and later

Timeline

2026-10-30: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.