Read the docs
TI-2026-15874 Aliases CVE-2026-19499GHSA-3vcj-mghm-mw9p

Buffer overflow in strfmon and strfmon_l right-justification padding

Priority LOW 33CWE-122Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
High · Low · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat.

Summary

Calling strfmon and strfmon_l in the GNU C Library version 2.38 to 2.44 can write past the end of the caller-supplied output buffer when a conversion uses right-justified width padding. Exploitation requires an application code path that calls strfmon or strfmon_l with right-justified width padding into a destination buffer that is large enough for the padding to succeed but too small for the internal memmove call. The field width or format may be attacker-influenced or a fixed susceptible pattern in the caller. At the time of publication, no network-facing application impact is known.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00297 22nd percentileScored 2026-11-07
Fix Fixed Red Hat: 2 advisories

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
GNUglibc2.38 – 2.44—No fix listedCNA
  • glibc VendorGNU Affected 2.38 – 2.44 Fixed in — No fix listed CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:gnu:glibc:*:*:*:*:*:*:*:*——GNU
  • cpe:2.3:a:gnu:glibc:*:*:*:*:*:*:*:* Versions — — ·GNU

Remediation

Red Hat 2 advisories

  • RHSA-2026:76781 Released 2026-10-08 · Red Hat rating Moderate
    glibc security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 10) glibc-devel-2.39-142.el10_2, glibc-doc-2.39-142.el10_2, glibc-locale-source-2.39-142.el10_2 +1
    • Red Hat Enterprise Linux BaseOS (v. 10) glibc-2.39-142.el10_2, glibc-all-langpacks-2.39-142.el10_2, glibc-common-2.39-142.el10_2 +47
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) glibc-benchtests-2.39-142.el10_2, glibc-nss-devel-2.39-142.el10_2, glibc-static-2.39-142.el10_2 +2
  • RHSA-2026:60865 Released 2026-08-29 · Red Hat rating Moderate
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images compat-libpthread-nonshared-2.43-8.3.hum1@aarch64, compat-libpthread-nonshared-2.43-8.3.hum1@x86_64, glibc-2.43-8.3.hum1@aarch64 +47

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2026:76781
Red Hat Enterprise Linux BaseOS (v. 10)Fixed RHSA-2026:76781
Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)Fixed RHSA-2026:76781
Red Hat Hardened ImagesFixed RHSA-2026:60865
Not affected: 6 products
  • Red Hat Enterprise Linux 6
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenShift Container Platform 5

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-19499
  2. 2026-10-03 Alias added: GHSA-3vcj-mghm-mw9p
  3. 2026-10-09 Fix available: RHSA-2026:76781 · Red Hat
  4. 2026-10-09 Fix available: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) · Red Hat
  5. 2026-10-31 Affected versions changed · Red Hat

References

Advisory 1

Other 1

  • TI-2026-19388 telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root"… KEVCVSS 3.1CRITICAL 9.8
  • TI-2014-05975 GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed… KEVCVSS 3.1CRITICAL 9.8
  • TI-2014-05157 GNU Bash through 4.3 processes trailing strings after function definitions in the values… KEVCVSS 3.1CRITICAL 9.8
  • TI-2014-05164 GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the… KEVCVSS 3.1HIGH 8.8
  • TI-2023-04522 Glibc: buffer overflow in ld.so leading to privilege escalation KEVCVSS 3.1HIGH 7.8
  • TI-2009-03392 The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft… CVSS 3.1CRITICAL 9.8
See all 1272 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences