Glibc closes LANGUAGE path traversal in gettext (CVE-2026-84243)
Attackers who can set LANGUAGE could force gettext programs to load crafted message catalogs from arbitrary paths.
By rvalue#glibc
glibc patches heap overflow in fopen ccs= handling
Empty charset names after stripping could make fopen read past a delimiter and corrupt the heap.
By rvalueglibc patches heap overflow in fopen ccs= charset handling
CVE-2026-18374 let a crafted empty charset name overrun a heap buffer when opening files with character conversion.
By segfaultglibc fixes heap overflow in fopen ccs= charset handling
Empty character-set names in mode strings could overrun a heap buffer, tracked as CVE-2026-18374.
By segfaultglibc patches heap overflow in fopen charset mode handling
CVE-2026-18374 let an empty ccs= mode string overflow a heap buffer; fopen now rejects it with EINVAL.
By rvalueglibc closes LANGUAGE path traversal in gettext loading
CVE-2026-84243 completes a 2014 locale fix so attackers who can set LANGUAGE cannot steer message catalogs to arbitrary .mo files.
By segfaultglibc plugs heap overflow in fopen ccs= charset handling
CVE-2026-18374 let a crafted mode string overrun a small heap buffer when a charset token stripped to empty.
By segfaultglibc plugs SHIFT_JISX0213 iconv hang (CVE-2026-77117)
The converter left pending combining-character state uncleared, so resumed iconv calls could stall instead of making progress.
By segfaultglibc fixes wordexp use-after-free on WRDE_APPEND errors
CVE-2026-6368 closed a dangling-pointer bug that could free the wrong buffer after a failed append expansion.
By segfaultglibc 2.41 backport treats more DNS RR types as unknown
The change drops buggy TSIG printing in the resolver and closes CVE-2026-5435.
By segfaultglibc 2.40 backport plugs one-byte scanf %mc overflow
CVE-2026-5450 fixed a user-controlled overflow when %mc or %mC resized its allocated buffer.
By segfaultglibc fixes one-byte overflow in scanf %mc allocation
Under-allocation when growing the buffer for the %mc and %mC conversions left a user-controlled write past the end of the heap block.
By rvalue