Buffer Overflow Vulnerability in GNU C Library Versions
CVE-2026-19499

7.7HIGH

Key Information:

Vendor

The Gnu C Library

Status
Glibc
Vendor
CVE Published:
14 September 2026

What is CVE-2026-19499?

A buffer overflow vulnerability has been identified in the GNU C Library, specifically in versions 2.38 to 2.44. The issue arises when the functions strfmon and strfmon_l are called with right-justified width padding, which can result in writing past the end of the caller-supplied output buffer. This flaw requires an application code path that uses these functions with a destination buffer susceptible to overflow due to insufficient size for internal operations. At this time, there are no known network-facing applications affected.

Affected Version(s)

glibc 2.38 <= 2.44

References

https://sourceware.org/bugzilla/show_bug.cgi?id=34510
issue-tracking
https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=ad...
vendor-advisory

CVSS V3.1

Score:
7.7
Severity:
HIGH
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

AISLE in partnership with Red Hat
.