Skip to content
OpenAdvisories
High · 7.7 CVE-2026-19499 EUVD-2026-77675GHSA-3vcj-mghm-mw9p

Buffer overflow in strfmon and strfmon_l right-justification padding

Published Sep 14, 2026 · Updated Sep 14, 2026 · Assigned by glibc

Vendor: The GNU C Library Product: glibc Package: glibc Package: glibc Package: glibc Package: glibc-2.43 Package: glibc-2.43-abi-report Package: glibc-2.43-dev Package: glibc-2.43-iconv Package: glibc-2.43-locale-ca Package: glibc-2.43-locale-de Package: glibc-2.43-locale-en Package: glibc-2.43-locale-es Package: glibc-2.43-locale-extra Package: glibc-2.43-locale-fr Package: glibc-2.43-locale-posix Package: glibc-2.43-locales Package: glibc-2.43-testresults Package: glibc-2.43-tracing Package: glibc-2.44 Package: glibc-2.44-abi-report Package: glibc-2.44-dev Package: glibc-2.44-iconv Package: glibc-2.44-locale-ca Package: glibc-2.44-locale-de Package: glibc-2.44-locale-en Package: glibc-2.44-locale-es Package: glibc-2.44-locale-extra Package: glibc-2.44-locale-fr Package: glibc-2.44-locale-posix Package: glibc-2.44-locales Package: glibc-2.44-testresults Package: glibc-2.44-tracing Package: ld-linux-2.43 Package: ld-linux-2.44 Package: libc-bin-2.43 Package: libc-bin-2.44 Package: libcrypt1-2.43 Package: libcrypt1-2.44 Package: localedef-2.43 Package: localedef-2.44 Package: nscd-2.43 Package: nscd-2.44 Package: nss-db-2.43 Package: nss-db-2.44 Package: nss-hesiod-2.43 Package: nss-hesiod-2.44 Package: pcprofiledump-2.43 Package: pcprofiledump-2.44 Package: posix-libc-utils-2.43 Package: posix-libc-utils-2.44 Package: posix-libc-utils-bin-2.43 Package: posix-libc-utils-bin-2.44 Package: sln-2.43 Package: sln-2.44 Package: sotruss-2.43 Package: sotruss-2.44 Package: tzutils-2.43 Package: tzutils-2.44 Ecosystem: Azure Linux Ecosystem: Debian Ecosystem: Ubuntu Ecosystem: Wolfi

Description

Calling strfmon and strfmon_l in the GNU C Library version 2.38 to 2.44 can write past the end of the caller-supplied output buffer when a conversion uses right-justified width padding.

Exploitation requires an application code path that calls strfmon or strfmon_l with right-justified width padding into a destination buffer that is large enough for the padding to succeed but too small for the internal memmove call. The field width or format may be attacker-influenced or a fixed susceptible pattern in the caller.

At the time of publication, no network-facing application impact is known.

Affected products

VendorProductAffectedFixed
The GNU C Library glibc 2.38 – ≤ 2.44 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 glibc 2.43-5 —
Debian 13 glibc No fix yet —
Debian 12 glibc No fix yet —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.04 LTS glibc 2.43-2ubuntu2.4 USN-8737-1
Ubuntu 24.04 LTS glibc 2.39-0ubuntu8.9 USN-8737-2
Ubuntu 22.04 LTS glibc 2.35-0ubuntu3.15 USN-8737-1

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 10 glibc +220 2.39-142.el10_2 RHSA-2026:76781
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Red Hat Hardened Images 1 glibc +227 2.43-8.3.hum1 RHSA-2026:60865

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 10 glibc +220 2.39-142.el10_2.alma.1 ALSA-2026:76781

Rocky Linux

Errata ↗
ReleasePackageFixed inAdvisory
Rocky Linux 10 glibc 2.39-142.el10_2 RLSA-2026:76781

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP7 glibc 2.38-150600.14.58.1 SUSE-SU-2026:4250-1
SLES 15 SP6 glibc 2.38-150600.14.58.1 SUSE-SU-2026:4250-1
Show 6 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 16.0 glibc 2.40-160000.7.1 SUSE-SU-2026:23934-1
SLES for SAP 15 SP6 glibc 2.38-150600.14.58.1 SUSE-SU-2026:4250-1
SLES 16.0 glibc 2.40-160000.7.1 SUSE-SU-2026:23934-1
SLE Micro 6.2 glibc 2.40-160000.7.1 SUSE-SU-2026:23957-1, SUSE-SU-2026:23929-1
SLE Micro 6.1 glibc 2.38-slfo.1.1_10.1 SUSE-SU-2026:23738-1
SLE Micro 6.0 glibc 2.38-15.1 SUSE-SU-2026:23830-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed glibc 2.44-2.1 openSUSE-SU-2026:11787-1
openSUSE Leap 16.0 glibc +4 2.40-160000.7.1 openSUSE-SU-2026:21968-1

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 glibc No fix yet —

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 10 glibc +220 2.39-145.0.1.el10_2 ELSA-2026-76781

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling sln-2.43 +26 2.43-r18 —
Wolfi rolling sln-2.44 +26 2.44-r4 —

Advisories 16

References