{"id":"CVE-2026-19499","summary":"Buffer overflow in strfmon and strfmon_l right-justification padding","details":"Calling strfmon and strfmon_l in the GNU C Library version 2.38 to 2.44 can write past the end of the caller-supplied output buffer when a conversion uses right-justified width padding.\n\nExploitation requires an application code path that calls strfmon or strfmon_l with right-justified width padding into a destination buffer that is large enough for the padding to succeed but too small for the internal memmove call. The field width or format may be attacker-influenced or a fixed susceptible pattern in the caller.\n\nAt the time of publication, no network-facing application impact is known.","modified":"2026-09-16T03:45:47.603402453Z","published":"2026-09-14T17:11:12.243Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/19xxx/CVE-2026-19499.json","cna_assigner":"glibc","cwe_ids":["CWE-122"]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/19xxx/CVE-2026-19499.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19499"},{"type":"ADVISORY","url":"https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0017"},{"type":"REPORT","url":"https://sourceware.org/bugzilla/show_bug.cgi?id=34510"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://sourceware.org/git/glibc.git","events":[{"introduced":"36f2487f13e3540be9ee0fb51876b1da72176d3f"},{"last_affected":"c3a3a9808ad3ab4a3336836833f83288b672ccbf"}],"database_specific":{"extracted_events":[{"introduced":"2.38"},{"last_affected":"2.44"}],"source":"AFFECTED_FIELD"}}],"versions":["glibc-2.44","glibc-2.43.9000","glibc-2.43","glibc-2.42","glibc-2.42.9000","glibc-2.41.9000","glibc-2.41","glibc-2.40","glibc-2.40.9000","glibc-2.39.9000","glibc-2.39","glibc-2.38","glibc-2.38.9000"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-19499.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:H"}]}