---
id: CVE-2026-19499
title: >-
  Calling strfmon and strfmon_l in the GNU C Library version 2.38 to 2.44 can
  write past the end of the caller-supplied output buffer when a conversion uses
  right-justified width padding.


  Exploitation requires an application code path tha…
summary: >-
  Calling strfmon and strfmon_l in the GNU C Library version 2.38 to 2.44 can
  write past the end of the caller-supplied output buffer when a conversion uses
  right-justified width padding.


  Exploitation requires an application code path tha…
severity: high
cvss: 7.7
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:H'
cwe:
  - CWE-122
  - CWE-787
vendor: The GNU C Library
product: glibc
affected:
  - glibc >= 2.38 <= 2.44
patched:
  - hardened_images
published: '2026-09-14'
updated: '2026-09-18'
sourceUpdated: '2026-09-18T18:17:47.257'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-19499'
references:
  - url: 'https://sourceware.org/bugzilla/show_bug.cgi?id=34510'
    label: 3ff69d7a-14f2-4f67-a097-88dee7810d18
  - url: >-
      https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0017
    label: 3ff69d7a-14f2-4f67-a097-88dee7810d18
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-19499.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-19499'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2523258'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-19499'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-19499'
  - url: 'https://access.redhat.com/errata/RHSA-2026:60865'
tags:
  - nvd
  - cve.org
  - csaf
  - vex
  - red-hat
epss: 0.00297
epssPercentile: 0.19954
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-14T19:40:33.799943Z'
scores:
  nvd: 7.7
  vendor: 6.8
ingestedAt: '2026-09-14T18:12:17.304Z'
---

## Overview

Calling strfmon and strfmon_l in the GNU C Library version 2.38 to 2.44 can write past the end of the caller-supplied output buffer when a conversion uses right-justified width padding.

Exploitation requires an application code path that calls strfmon or strfmon_l with right-justified width padding into a destination buffer that is large enough for the padding to succeed but too small for the internal memmove call. The field width or format may be attacker-influenced or a fixed susceptible pattern in the caller.

At the time of publication, no network-facing application impact is known.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **RHSA-2026:60865** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-08-29 · [advisory](https://access.redhat.com/errata/RHSA-2026:60865)
- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat Enterprise Linux 10 · updated 2026-09-14 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-19499.json)