Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-19499— Buffer overflow in strfmon and strfmon_l right-justification padding

Quick assessment

Affected
The GNU C Library glibc
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

GNU glibc是美国GNU基金会开源的一个 GNU 计划所实现的 C 标准库。 GNU glibc 2.38版本至2.44版本存在缓冲区错误漏洞，该漏洞源于调用strfmon和strfmon_l时，转换使用右对齐宽度填充可能导致写越调用者提供的输出缓冲区末尾，造成堆缓冲区溢出，进而导致内存损坏、崩溃或执行任意代码。

CVSS 7.7 · High EPSS 0.30% · P22

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

VendorProduct Version RangeStatus
The GNU C Library glibc 2.38≤ 2.44 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-19499

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Buffer overflow in strfmon and strfmon_l right-justification padding
Source: CVE Program / CVE List V5
Vulnerability Description
Calling strfmon and strfmon_l in the GNU C Library version 2.38 to 2.44 can write past the end of the caller-supplied output buffer when a conversion uses right-justified width padding. Exploitation requires an application code path that calls strfmon or strfmon_l with right-justified width padding into a destination buffer that is large enough for the padding to succeed but too small for the internal memmove call. The field width or format may be attacker-influenced or a fixed susceptible pattern in the caller. At the time of publication, no network-facing application impact is known.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
堆缓冲区溢出
Source: CVE Program / CVE List V5
Vulnerability Title
GNU glibc 缓冲区错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
GNU glibc是美国GNU基金会开源的一个 GNU 计划所实现的 C 标准库。 GNU glibc 2.38版本至2.44版本存在缓冲区错误漏洞，该漏洞源于调用strfmon和strfmon_l时，转换使用右对齐宽度填充可能导致写越调用者提供的输出缓冲区末尾，造成堆缓冲区溢出，进而导致内存损坏、崩溃或执行任意代码。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
The GNU C Library glibc 2.38 ~ 2.44 -

II. Public POCs for CVE-2026-19499

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-19499

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-19499 (2)

IV. Related Vulnerabilities

Same product: glibc
Same vendor: The GNU C Library
Same weakness: CWE-122