Vulnerability · Published Sep 14, 2026 · Assigned by glibc

CVE-2026-19499Buffer overflow in strfmon and strfmon_l right-justification padding

High 7.7

In plain English

A high-severity heap buffer overflow in glibc from The GNU C Library. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.7High
Exploit odds (30 days)0.3%top 77.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Calling strfmon and strfmon_l in the GNU C Library version 2.38 to 2.44 can write past the end of the caller-supplied output buffer when a conversion uses right-justified width padding. Exploitation requires an application code path that calls strfmon or strfmon_l with right-justified width padding into a destination buffer that is large enough for the padding to succeed but too small for the internal memmove call. The field width or format may be attacker-influenced or a fixed susceptible pattern in the caller. At the time of publication, no network-facing application impact is known.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:10glibc2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-all-langpacks2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-benchtests2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-common2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-devel2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-doc2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-gconv-extra2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-aa2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-af2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-agr2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-ak2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-am2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-an2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-anp2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-ar2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-as2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-ast2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-ayc2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-az2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-be2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-bem2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-ber2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-bg2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-bhb2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-bho2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-bi2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-bn2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-bo2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-br2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-brx2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-bs2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-byn2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-ca2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-ce2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-chr2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-ckb2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-cmn2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-crh2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-cs2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-csb2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-cv2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-cy2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-da2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-de2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-doi2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-dsb2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-dv2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-dz2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-el2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-en2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-eo2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-es2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-et2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-eu2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-fa2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-ff2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-fi2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-fil2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-fo2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-fr2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-fur2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-fy2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-ga2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-gbm2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-gd2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-gez2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-gl2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-gu2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-gv2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-ha2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-hak2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-he2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-hi2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-hif2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-hne2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-hr2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-hsb2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-ht2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-hu2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-hy2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-ia2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-id2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-ig2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-ik2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-is2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-it2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-iu2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-ja2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-ka2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-kab2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-kk2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-kl2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-km2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-kn2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-ko2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-kok2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-ks2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-ku2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-kv2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-kw2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-ky2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-lb2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-lg2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-li2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-lij2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-ln2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-lo2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-lt2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-lv2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-lzh2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-mag2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-mai2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-mfe2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-mg2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-mhr2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-mi2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-miq2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-mjw2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-mk2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-ml2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-mn2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-mni2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-mnw2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-mr2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-ms2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-mt2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-my2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-nan2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-nb2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-nds2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-ne2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-nhn2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-niu2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-nl2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-nn2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-nr2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-nso2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-oc2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-om2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-or2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-os2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-pa2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-pap2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-pl2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-ps2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-pt2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-quz2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-raj2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-rif2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-ro2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-ru2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-rw2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-sa2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-sah2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-sat2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-sc2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-sd2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-se2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-sgs2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-shn2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-shs2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-si2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-sid2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-sk2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-sl2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-sm2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-so2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-sq2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-sr2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-ss2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-ssy2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-st2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-su2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-sv2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-sw2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-syr2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-szl2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-ta2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-tcy2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-te2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-tg2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-th2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-the2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-ti2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-tig2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-tk2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-tl2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-tn2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-to2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-tok2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-tpi2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-tr2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-ts2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-tt2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-ug2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-uk2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-unm2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-ur2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-uz2.39-142.el10_2.alma.1ALSA-2026:76781
AlmaLinux:10glibc-langpack-ve2.39-142.el10_2.alma.1ALSA-2026:76781

Affected products (as reported)

VendorProductVersions
The GNU C Library glibc 2.38 – through 2.44

Weakness: CWE-122 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:H

References