SZB-4e0c95e41d
EUVD-2026-114247 reports gettext LANGUAGE input flaw in glibc (CVSS 7.0)
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- GNU C Library
- Product
- glibc
- First seen
Summary
The EUVD listing says the gettext functions in GNU C Library 2.0 and later accept LANGUAGE entries containing '/' or equal to '..' in programs that are not setuid or setgid. The item is a feed post quoting the EUVD record, and its description is truncated before it states the full impact.
If you use GNU C Library
Check whether your systems run glibc versions covered by EUVD-2026-114247
Apply the glibc update from your Linux distribution when it is released
Review the EUVD record for the full impact and affected version range
What the sources say 1
· Mastodon: “The gettext family of functions in the GNU C Library version 2.0 and later accept LANGUAGE environment variable entries that contain '/' or that are equal to "..", unless the program is setuid or setgid (AT_SECURE).” Source