UBUNTU-CVE-2026-19499
- Source
- https://ubuntu.com/security/CVE-2026-19499
- Import Source
- https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-19499.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/UBUNTU-CVE-2026-19499
- Upstream
- Downstream
- Related
- Published
- 2026-08-27T00:00:00Z
- Modified
- 2026-09-16T14:01:36Z
- Severity
-
- 7.7 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:H CVSS Calculator
- Ubuntu - medium
- Summary
- [none]
- Details
-
Calling strfmon and strfmon_l in the GNU C Library version 2.38 to 2.44 can write past the end of the caller-supplied output buffer when a conversion uses right-justified width padding. Exploitation requires an application code path that calls strfmon or strfmon_l with right-justified width padding into a destination buffer that is large enough for the padding to succeed but too small for the internal memmove call. The field width or format may be attacker-influenced or a fixed susceptible pattern in the caller. At the time of publication, no network-facing application impact is known.
- References
Affected packages
Ubuntu:24.04:LTS / glibc
Package
- Name
- glibc
- Purl
- pkg:deb/ubuntu/glibc?arch=source&distro=noble
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affectedFixed2.39-0ubuntu8.9
Affected versions
2.*
2.38-1ubuntu6
2.38-3ubuntu1
2.39-0ubuntu1
2.39-0ubuntu2
2.39-0ubuntu6
2.39-0ubuntu8
2.39-0ubuntu8.1
2.39-0ubuntu8.2
2.39-0ubuntu8.3
2.39-0ubuntu8.4
2.39-0ubuntu8.5
2.39-0ubuntu8.6
2.39-0ubuntu8.7
2.39-0ubuntu8.8
Ecosystem specific
{
"availability": "No subscription required",
"binaries": [
{
"binary_name": "glibc-source",
"binary_version": "2.39-0ubuntu8.9"
},
{
"binary_name": "libc-bin",
"binary_version": "2.39-0ubuntu8.9"
},
{
"binary_name": "libc-dev-bin",
"binary_version": "2.39-0ubuntu8.9"
},
{
"binary_name": "libc-devtools",
"binary_version": "2.39-0ubuntu8.9"
},
{
"binary_name": "libc6",
"binary_version": "2.39-0ubuntu8.9"
},
{
"binary_name": "libc6-amd64",
"binary_version": "2.39-0ubuntu8.9"
},
{
"binary_name": "libc6-dev-amd64",
"binary_version": "2.39-0ubuntu8.9"
},
{
"binary_name": "libc6-dev-i386",
"binary_version": "2.39-0ubuntu8.9"
},
{
"binary_name": "libc6-dev-s390",
"binary_version": "2.39-0ubuntu8.9"
},
{
"binary_name": "libc6-dev-x32",
"binary_version": "2.39-0ubuntu8.9"
},
{
"binary_name": "libc6-i386",
"binary_version": "2.39-0ubuntu8.9"
},
{
"binary_name": "libc6-s390",
"binary_version": "2.39-0ubuntu8.9"
},
{
"binary_name": "libc6-x32",
"binary_version": "2.39-0ubuntu8.9"
},
{
"binary_name": "locales",
"binary_version": "2.39-0ubuntu8.9"
},
{
"binary_name": "locales-all",
"binary_version": "2.39-0ubuntu8.9"
},
{
"binary_name": "nscd",
"binary_version": "2.39-0ubuntu8.9"
}
]
}
Ubuntu:26.04:LTS / glibc
Package
- Name
- glibc
- Purl
- pkg:deb/ubuntu/glibc?arch=source&distro=resolute
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affectedFixed2.43-2ubuntu2.4
Affected versions
2.*
2.42-0ubuntu3
2.42-2ubuntu1
2.42-2ubuntu2
2.42-2ubuntu4
2.42-2ubuntu5
2.43-2ubuntu1
2.43-2ubuntu2
2.43-2ubuntu2.3
Ecosystem specific
{
"availability": "No subscription required",
"binaries": [
{
"binary_name": "glibc-source",
"binary_version": "2.43-2ubuntu2.4"
},
{
"binary_name": "libc-bin",
"binary_version": "2.43-2ubuntu2.4"
},
{
"binary_name": "libc-dev-bin",
"binary_version": "2.43-2ubuntu2.4"
},
{
"binary_name": "libc-devtools",
"binary_version": "2.43-2ubuntu2.4"
},
{
"binary_name": "libc-gconv-modules-extra",
"binary_version": "2.43-2ubuntu2.4"
},
{
"binary_name": "libc6",
"binary_version": "2.43-2ubuntu2.4"
},
{
"binary_name": "libc6-amd64",
"binary_version": "2.43-2ubuntu2.4"
},
{
"binary_name": "libc6-dev-amd64",
"binary_version": "2.43-2ubuntu2.4"
},
{
"binary_name": "libc6-dev-i386",
"binary_version": "2.43-2ubuntu2.4"
},
{
"binary_name": "libc6-dev-x32",
"binary_version": "2.43-2ubuntu2.4"
},
{
"binary_name": "libc6-i386",
"binary_version": "2.43-2ubuntu2.4"
},
{
"binary_name": "libc6-x32",
"binary_version": "2.43-2ubuntu2.4"
},
{
"binary_name": "locales",
"binary_version": "2.43-2ubuntu2.4"
},
{
"binary_name": "locales-all",
"binary_version": "2.43-2ubuntu2.4"
},
{
"binary_name": "nscd",
"binary_version": "2.43-2ubuntu2.4"
}
]
}