CVE-2026-19499
Received Received - Intake

Buffer Overflow in GNU C Library strfmon

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: GNU C Library

Description
Calling strfmon and strfmon_l in the GNU C Library version 2.38 to 2.44 can write past the end of the caller-supplied output buffer when a conversion uses right-justified width padding. Exploitation requires an application code path that calls strfmon or strfmon_l with right-justified width padding into a destination buffer that is large enough for the padding to succeed but too small for the internal memmove call. The field width or format may be attacker-influenced or a fixed susceptible pattern in the caller. At the time of publication, no network-facing application impact is known.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-09-14
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2026-19499
EUVD
EUVD-2026-77675

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
gnu gnu_c_library From 2.38 (inc) to 2.44 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-122 A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves a buffer overflow in the GNU C Library's strfmon and strfmon_l functions. When these functions use right-justified width padding, they can write data beyond the allocated output buffer if the buffer is sized for padding but too small for internal operations. Exploitation requires specific conditions in the calling application.

Detection Guidance

Detection requires identifying applications using strfmon or strfmon_l with right-justified width padding in GNU C Library versions 2.38 to 2.44. Check for applications linked against these library versions and review code paths calling these functions with dynamic width inputs.

Impact Analysis

An attacker could potentially execute arbitrary code or cause a denial of service by exploiting this flaw. However, the vulnerability requires a specific application code path and buffer size mismatch, making exploitation difficult. No known network-facing impact exists at this time.

Compliance Impact

This vulnerability involves a buffer overflow in strfmon and strfmon_l functions in the GNU C Library, which could lead to memory corruption. While not directly tied to data privacy standards like GDPR or HIPAA, such vulnerabilities could potentially expose sensitive data if exploited, leading to non-compliance with these regulations due to unauthorized access or data breaches.

Mitigation Strategies

Update the GNU C Library to a version patched against this issue. If immediate updates are not possible, restrict applications using strfmon or strfmon_l to trusted inputs and validate buffer sizes before calls. Monitor vendor advisories for patches.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19499. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart