Out-of-bounds write in GNU C Library (glibc) - CVE-2026-19499

Vulnerability identifier: #VU150022

CSH Severity: Medium

CVSS v4: 8.4 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-19499

CWE-ID: CWE-787

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to write beyond a caller-supplied output buffer.

The vulnerability exists due to a buffer overflow in strfmon and strfmon_l when processing a conversion with right-justified width padding. A remote attacker can supply a crafted format or field width to write beyond a caller-supplied output buffer.

Exploitation requires a destination buffer large enough for padding but too small for the internal memmove operation.

GNU C Library (glibc)
Anolis OS
openEuler
glibc-doc
compat-libpthread-nonshared
glibc
glibc-all-langpacks
glibc-benchtests
glibc-common
glibc-devel
glibc-gconv-extra
glibc-langpack-en
glibc-langpack-zh
glibc-locale-source
glibc-minimal-langpack
glibc-nss-devel
glibc-static
glibc-utils
libnsl
nss_db
nss_hesiod
glibc-help
nss_modules
nscd
glibc-debuginfo
glibc-debugsource
glibc-debugutils
glibc-locale-archive

Install security update from vendor's website.

GNU C Library (glibc) - update to 2.45
glibc-doc - update to 2.38-31
compat-libpthread-nonshared - update to 2.38-31
glibc - update to 2.38-31
glibc-all-langpacks - update to 2.38-31
glibc-benchtests - update to 2.38-31
glibc-common - update to 2.38-31
glibc-devel - update to 2.38-31
glibc-gconv-extra - update to 2.38-31
glibc-langpack-en - update to 2.38-31
glibc-langpack-zh - update to 2.38-31
glibc-locale-source - update to 2.38-31
glibc-minimal-langpack - update to 2.38-31
glibc-nss-devel - update to 2.38-31
glibc-static - update to 2.38-31
glibc-utils - update to 2.38-31
libnsl - update to 2.38-31
nss_db - update to 2.38-31
nss_hesiod - update to 2.38-31
glibc-nss-devel - update to 2.38-124
glibc-help - update to 2.38-124
nss_modules - update to 2.38-124
nscd - update to 2.38-124
libnsl - update to 2.38-124
glibc-all-langpacks - update to 2.38-124
glibc-common - update to 2.38-124
glibc-debuginfo - update to 2.38-124
glibc-debugsource - update to 2.38-124
glibc-debugutils - update to 2.38-124
glibc-devel - update to 2.38-124
glibc-locale-archive - update to 2.38-124
glibc-locale-source - update to 2.38-124
glibc - update to 2.38-124

• https://www.openwall.com/lists/oss-security/2026/09/14/31
• https://sourceware.org/git/?p=glibc.git;a=commit;h=b090cf226ff65b913e41536f1f573f500855615c

• Multiple vulnerabilities in GNU C Library (glibc)
• openEuler 24.03 LTS SP3 update for glibc
• openEuler 24.03 LTS SP1 update for glibc
• Anolis OS update for glibc