CVE-2026-19499— Buffer overflow in strfmon and strfmon_l right-justification padding
Quick assessment
Affected
The GNU C Library glibc
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 GNU C 库（版本 2.38 到 2.44）中，调用 和 时，当转换使用了右对齐的宽度填充时，可能会写入超出调用者提供的输出缓冲区的末尾。 利用该漏洞需要应用代码路径满足以下条件：调用 或 并使用了右对齐的宽度填充，目标缓冲区对于填充操作足够大，但对于内部的 调用又太小。字段宽度或格式可以由攻击者影响，或为调用方中固定的易受影响的模式。 在公告发布时，尚不知晓该漏洞对面向网络的应用程序有何影响。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| The GNU C Library | glibc | 2.38≤ 2.44 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-19499
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Buffer overflow in strfmon and strfmon_l right-justification padding
Source: CVE Program / CVE List V5
Vulnerability Description
Calling strfmon and strfmon_l in the GNU C Library version 2.38 to 2.44 can write past the end of the caller-supplied output buffer when a conversion uses right-justified width padding.
Exploitation requires an application code path that calls strfmon or strfmon_l with right-justified width padding into a destination buffer that is large enough for the padding to succeed but too small for the internal memmove call. The field width or format may be attacker-influenced or a fixed susceptible pattern in the caller.
At the time of publication, no network-facing application impact is known.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
堆缓冲区溢出
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| The GNU C Library | glibc | 2.38 ~ 2.44 | - |
|
II. Public POCs for CVE-2026-19499
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-19499
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-19499 (2)
-
🔗 Making sure you're not a bot! vendor-advisory
-
🔗 Making sure you're not a bot! issue-tracking
IV. Related Vulnerabilities
Same product: glibc
-
CVE-2026-19542
Stack-based out-of-bounds write in tdelete during tree rebal -
CVE-2026-89092
Stack overflow in nscd due to unbounded alloca use -
CVE-2026-18374
GNU C Library 缓冲区错误漏洞 -
CVE-2026-6791
Potential stack-based buffer clash during tilde expansion in -
CVE-2026-6368
wordexp with WRDE_APPEND can return or use invalid memory
Same vendor: The GNU C Library
-
CVE-2026-19542
Stack-based out-of-bounds write in tdelete during tree rebal -
CVE-2026-89092
Stack overflow in nscd due to unbounded alloca use -
CVE-2026-18374
GNU C Library 缓冲区错误漏洞 -
CVE-2026-6791
Potential stack-based buffer clash during tilde expansion in -
CVE-2026-6238
Buffer overread in ns_printrrf with corrupted RDATA field
Same weakness: CWE-122
-
CVE-2026-90682
Matthias-Wandel jhead WebP EXIF gpsinfo.c ProcessGpsInfo hea -
CVE-2025-64031
Libarchive 3.8.x 堆溢出（CVE-2025-6027） -
CVE-2026-23788
Exynos DPU堆溢出致系统崩溃 -
CVE-2026-90577
GPAC MP4Box base_scenegraph.c gf_node_get_field heap-based o -
CVE-2026-90556
Freeciv before 3.2.6 Heap Buffer Overflow via worklist_load
V. Comments for CVE-2026-19499
No comments yet