CVE-2026-19499

Calling strfmon and strfmon_l in the GNU C Library version 2.38 to 2.44 can write past the end of the caller-supplied output buffer when a conversion uses right-justified width padding.

Exploitation requires an application code path that calls strfmon or strfmon_l with right-justified width padding into a destination buffer that is large enough for the padding to succeed but too small for the internal memmove call. The field width or format may be attacker-influenced or a fixed susceptible pattern in the caller.

At the time of publication, no network-facing application impact is known.

Database specific

{
    "cna_assigner": "glibc",
    "cwe_ids": [
        "CWE-122"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/19xxx/CVE-2026-19499.json"
}

References

Affected packages

Git / sourceware.org/git/glibc.git

Affected ranges

Type

GIT

Repo

https://sourceware.org/git/glibc.git

Events

Introduced

36f2487f13e3540be9ee0fb51876b1da72176d3f

Last Affected

c3a3a9808ad3ab4a3336836833f83288b672ccbf

Database specific

Show details

{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "2.38"
                },
                {
                    "last_affected": "2.44"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
        }
    ]
}

Affected versions

glibc-2.*

glibc-2.38

glibc-2.38.9000

glibc-2.39

glibc-2.39.9000

glibc-2.40

glibc-2.40.9000

glibc-2.41

glibc-2.41.9000

glibc-2.42

glibc-2.42.9000

glibc-2.43

glibc-2.43.9000

glibc-2.44

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-19499.json"