CVE-2026-19499
published 2026-09-14CVE-2026-19499: Calling strfmon and strfmon_l in the GNU C Library version 2.38 to 2.44 can write past the end of the caller-supplied output buffer when a conversion uses…
PriorityP346high7.7CVSS 3.1
AVNACHPRNUINSUCHILAH
EPSS
0.30%
21.2th percentile
Calling strfmon and strfmon_l in the GNU C Library version 2.38 to 2.44 can write past the end of the caller-supplied output buffer when a conversion uses right-justified width padding.
Exploitation requires an application code path that calls strfmon or strfmon_l with right-justified width padding into a destination buffer that is large enough for the padding to succeed but too small for the internal memmove call. The field width or format may be attacker-influenced or a fixed susceptible pattern in the caller.
At the time of publication, no network-facing application impact is known.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| gnu | glibc | — | — |
| the_gnu_c_library | glibc | 2.38 – 2.44 | — |
| ubuntu | glibc | — | — |
CVSS provenance
nvdv3.17.7HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:H
vendor_redhat6.8MEDIUM
vendor_ubuntu2.1LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
GNU C Library vulnerabilities
vendor_ubuntu·2026-09-10·CVSS 2.1
CVE-2026-77117 [LOW] GNU C Library vulnerabilities
Title: GNU C Library vulnerabilities
Summary: Several security issues were fixed in GNU C Library.
USN-8737-1 fixed vulnerabilities in GNU C Library. This update provides
the corresponding fixes for Ubuntu 24.04 LTS.
Original advisory details:
It was discovered that GNU C Library had a buffer overflow in the strfmon
function when handling right-justification padding. An attacker could
possibly use this issue to cause a denial of service or execute arbitrary
code. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-19499)
It was discovered that GNU C Library had an out-of-bounds stack array
access in the tdelete function. An attacker could possibly use this issue
to cause a denial of service or execute arbitrary code. (CVE-2026-19542)
It was discovered that GNU C Library incorrectly
Ubuntu
GNU C Library vulnerabilities
vendor_ubuntu·2026-09-08·CVSS 2.1
CVE-2026-77117 [LOW] GNU C Library vulnerabilities
Title: GNU C Library vulnerabilities
Summary: Several security issues were fixed in GNU C Library.
It was discovered that GNU C Library had a buffer overflow in the strfmon
function when handling right-justification padding. An attacker could
possibly use this issue to cause a denial of service or execute arbitrary
code. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-19499)
It was discovered that GNU C Library had an out-of-bounds stack array
access in the tdelete function. An attacker could possibly use this issue
to cause a denial of service or execute arbitrary code. (CVE-2026-19542)
It was discovered that GNU C Library incorrectly handled memory when
calling wordexp with the WRDE_APPEND flag. An attacker could possibly use
this issue to cause a denial of service. (CVE-2026-63
Red Hat
glibc: Buffer Overflow in strfmon right-justification padding
vendor_redhat·2026-08-25·CVSS 6.8
CVE-2026-19499 [MEDIUM] CWE-787 glibc: Buffer Overflow in strfmon right-justification padding
glibc: Buffer Overflow in strfmon right-justification padding
A flaw was found in glibc. The strfmon and strfmon_l functions are vulnerable to a buffer overflow when processing right-justified width padding. This occurs because an incorrect length is used for an internal memory operation, causing data to be written beyond its intended buffer. An attacker could exploit this by providing specially crafted input, potentially leading to arbitrary code execution or other severe impacts.
Statement: This Moderate impact buffer overflow in `strfmon` or `strfmon_l` within glibc occurs when an application uses right-justified width padding with a specific buffer size, leading to an out-of-bounds write. Exploitation requires a vulnerable application code path that processes attacker-controlled form
VulDB
GNU glibc up to 2.44 strfmon buffer overflow (Nessus ID 364488 / WID-SEC-2026-3014)
vuldb·2026-10-10·CVSS 7.7
CVE-2026-19499 [HIGH] GNU glibc up to 2.44 strfmon buffer overflow (Nessus ID 364488 / WID-SEC-2026-3014)
A vulnerability has been found in GNU glibc up to 2.44 and classified as problematic. Affected by this vulnerability is the function strfmon. Performing a manipulation results in buffer overflow.
This vulnerability was named CVE-2026-19499. The attack needs to be approached locally. There is no available exploit.
GHSA
Calling strfmon and strfmon_l in the GNU C Library version 2.38 to 2.44 can write past the end of the caller-supplied output buffer when a conversion uses right-justified width padding.
ghsa_unreviewed·2026-09-14
CVE-2026-19499 [HIGH] CWE-122 Calling strfmon and strfmon_l in the GNU C Library version 2.38 to 2.44 can write past the end of the caller-supplied output buffer when a conversion uses right-justified width padding.
Calling strfmon and strfmon_l in the GNU C Library version 2.38 to 2.44 can write past the end of the caller-supplied output buffer when a conversion uses right-justified width padding.
Exploitation requires an application code path that calls strfmon or strfmon_l with right-justified width padding into a destination buffer that is large enough for the padding to succeed but too small for the internal memmove call. The field width or format may be attacker-influenced or a fixed susceptible pattern in the caller.
At the time of publication, no network-facing application impact is known.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-19499 zig: Buffer Overflow in strfmon right-justification padding [epel-all]
bugzilla·2026-08-25
CVE-2026-19499 [MEDIUM] CVE-2026-19499 zig: Buffer Overflow in strfmon right-justification padding [epel-all]
CVE-2026-19499 zig: Buffer Overflow in strfmon right-justification padding [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Summary: Buffer Overflow in strfmon right-justification padding:
out-of-bounds write in the caller-supplied output buffer caused by using
the post-padding length for the in-place `memmove`.
Requirements to exploit: A reachable application code path must invoke
`strfmon` or `strfmon_l` with right-justified width padding and a
destination buffer that is large enough for `__printf_buffer_pad` to
succeed but not large enough for the subsequent overlong `memmove`. This
may arise through a
Bugzilla
CVE-2026-19499 zig: Buffer Overflow in strfmon right-justification padding [fedora-all]
bugzilla·2026-08-25
CVE-2026-19499 [MEDIUM] CVE-2026-19499 zig: Buffer Overflow in strfmon right-justification padding [fedora-all]
CVE-2026-19499 zig: Buffer Overflow in strfmon right-justification padding [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Summary: Buffer Overflow in strfmon right-justification padding:
out-of-bounds write in the caller-supplied output buffer caused by using
the post-padding length for the in-place `memmove`.
Requirements to exploit: A reachable application code path must invoke
`strfmon` or `strfmon_l` with right-justified width padding and a
destination buffer that is large enough for `__printf_buffer_pad` to
succeed but not large enough for the subsequent overlong `memmove`. This
may arise through
Bugzilla
CVE-2026-19499 glibc: Buffer Overflow in strfmon right-justification padding
bugzilla·2026-08-25
CVE-2026-19499 [MEDIUM] CVE-2026-19499 glibc: Buffer Overflow in strfmon right-justification padding
CVE-2026-19499 glibc: Buffer Overflow in strfmon right-justification padding
Summary: Buffer Overflow in strfmon right-justification padding:
out-of-bounds write in the caller-supplied output buffer caused by using
the post-padding length for the in-place `memmove`.
Requirements to exploit: A reachable application code path must invoke
`strfmon` or `strfmon_l` with right-justified width padding and a
destination buffer that is large enough for `__printf_buffer_pad` to
succeed but not large enough for the subsequent overlong `memmove`. This
may arise through attacker-influenced formatting input or through a fixed
susceptible formatting pattern in the calling application.
Bugzilla
CVE-2026-19499 glibc: Buffer Overflow in strfmon right-justification padding [fedora-all]
bugzilla·2026-08-25
CVE-2026-19499 [MEDIUM] CVE-2026-19499 glibc: Buffer Overflow in strfmon right-justification padding [fedora-all]
CVE-2026-19499 glibc: Buffer Overflow in strfmon right-justification padding [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Summary: Buffer Overflow in strfmon right-justification padding:
out-of-bounds write in the caller-supplied output buffer caused by using
the post-padding length for the in-place `memmove`.
Requirements to exploit: A reachable application code path must invoke
`strfmon` or `strfmon_l` with right-justified width padding and a
destination buffer that is large enough for `__printf_buffer_pad` to
succeed but not large enough for the subsequent overlong `memmove`. This
may arise throu
2026-09-14
Published