CVE-2026-19499 Buffer overflow in strfmon and strfmon_l right-justification padding
Buffer overflow in glibc strfmon functions allows attackers to write past buffer boundaries, potentially causing crashes or code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-19499?
CVE-2026-19499 is a high-severity memory corruption vulnerability in The GNU C Library glibc, published on 14 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Calling strfmon and strfmon_l in the GNU C Library version 2.38 to 2.44 can write past the end of the caller-supplied output buffer when a conversion uses right-justified width padding.
Exploitation requires an application code path that calls strfmon or strfmon_l with right-justified width padding into a destination buffer that is large enough for the padding to succeed but too small for the internal memmove call. The field width or format may be attacker-influenced or a fixed susceptible pattern in the caller.
At the time of publication, no network-facing application impact is known.
Weakness: CWE-122
Which versions are affected by CVE-2026-19499?
Linux distribution packages (40)
compat-libpthread-nonshared Red Hat:hummingbird:1 | All versions | 0:2.43-8.3.hum1 |
glibc Red Hat:hummingbird:1 | All versions | 0:2.43-8.3.hum1 |
glibc-all-langpacks Red Hat:hummingbird:1 | All versions | 0:2.43-8.3.hum1 |
glibc-benchtests Red Hat:hummingbird:1 | All versions | 0:2.43-8.3.hum1 |
glibc-common Red Hat:hummingbird:1 | All versions | 0:2.43-8.3.hum1 |
glibc-devel Red Hat:hummingbird:1 | All versions | 0:2.43-8.3.hum1 |
glibc-doc Red Hat:hummingbird:1 | All versions | 0:2.43-8.3.hum1 |
glibc-gconv-extra Red Hat:hummingbird:1 | All versions | 0:2.43-8.3.hum1 |
glibc-langpack-aa Red Hat:hummingbird:1 | All versions | 0:2.43-8.3.hum1 |
glibc-langpack-af Red Hat:hummingbird:1 | All versions | 0:2.43-8.3.hum1 |
glibc-langpack-agr Red Hat:hummingbird:1 | All versions | 0:2.43-8.3.hum1 |
glibc-langpack-ak Red Hat:hummingbird:1 | All versions | 0:2.43-8.3.hum1 |
glibc-langpack-am Red Hat:hummingbird:1 | All versions | 0:2.43-8.3.hum1 |
glibc-langpack-an Red Hat:hummingbird:1 | All versions | 0:2.43-8.3.hum1 |
glibc-langpack-anp Red Hat:hummingbird:1 | All versions | 0:2.43-8.3.hum1 |
glibc-langpack-ar Red Hat:hummingbird:1 | All versions | 0:2.43-8.3.hum1 |
glibc-langpack-as Red Hat:hummingbird:1 | All versions | 0:2.43-8.3.hum1 |
glibc-langpack-ast Red Hat:hummingbird:1 | All versions | 0:2.43-8.3.hum1 |
glibc-langpack-ayc Red Hat:hummingbird:1 | All versions | 0:2.43-8.3.hum1 |
glibc-langpack-az Red Hat:hummingbird:1 | All versions | 0:2.43-8.3.hum1 |
glibc-langpack-be Red Hat:hummingbird:1 | All versions | 0:2.43-8.3.hum1 |
glibc-langpack-bem Red Hat:hummingbird:1 | All versions | 0:2.43-8.3.hum1 |
glibc-langpack-ber Red Hat:hummingbird:1 | All versions | 0:2.43-8.3.hum1 |
glibc-langpack-bg Red Hat:hummingbird:1 | All versions | 0:2.43-8.3.hum1 |
glibc-langpack-bhb Red Hat:hummingbird:1 | All versions | 0:2.43-8.3.hum1 |
glibc-langpack-bho Red Hat:hummingbird:1 | All versions | 0:2.43-8.3.hum1 |
glibc-langpack-bi Red Hat:hummingbird:1 | All versions | 0:2.43-8.3.hum1 |
glibc-langpack-bn Red Hat:hummingbird:1 | All versions | 0:2.43-8.3.hum1 |
glibc-langpack-bo Red Hat:hummingbird:1 | All versions | 0:2.43-8.3.hum1 |
glibc-langpack-br Red Hat:hummingbird:1 | All versions | 0:2.43-8.3.hum1 |
glibc-langpack-brx Red Hat:hummingbird:1 | All versions | 0:2.43-8.3.hum1 |
glibc-langpack-bs Red Hat:hummingbird:1 | All versions | 0:2.43-8.3.hum1 |
glibc-langpack-byn Red Hat:hummingbird:1 | All versions | 0:2.43-8.3.hum1 |
glibc-langpack-ca Red Hat:hummingbird:1 | All versions | 0:2.43-8.3.hum1 |
glibc-langpack-ce Red Hat:hummingbird:1 | All versions | 0:2.43-8.3.hum1 |
glibc-langpack-chr Red Hat:hummingbird:1 | All versions | 0:2.43-8.3.hum1 |
glibc-langpack-ckb Red Hat:hummingbird:1 | All versions | 0:2.43-8.3.hum1 |
glibc-langpack-cmn Red Hat:hummingbird:1 | All versions | 0:2.43-8.3.hum1 |
glibc-langpack-crh Red Hat:hummingbird:1 | All versions | 0:2.43-8.3.hum1 |
glibc-langpack-cs Red Hat:hummingbird:1 | All versions | 0:2.43-8.3.hum1 |
How do I fix CVE-2026-19499?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-19499 being exploited?
There is no known exploitation of CVE-2026-19499 in the wild and no public exploit code.
Sources
Also known as AZL-100962, BELL-CVE-2026-19499, DEBIAN-CVE-2026-19499, ECHO-0b68-19f2-1a40, GHSA-3vcj-mghm-mw9p, RHSA-2026:60865 and 3 more.