Out-of-bounds write in GNU C Library (glibc) - CVE-2026-19499

Vulnerability identifier: #VU150022

CSH Severity: Medium

CVSS v4: 8.4 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-19499

CWE-ID: CWE-787

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to write beyond a caller-supplied output buffer.

The vulnerability exists due to a buffer overflow in strfmon and strfmon_l when processing a conversion with right-justified width padding. A remote attacker can supply a crafted format or field width to write beyond a caller-supplied output buffer.

Exploitation requires a destination buffer large enough for padding but too small for the internal memmove operation.

GNU C Library (glibc)
openEuler
glibc
glibc-help
nss_modules
nscd
libnsl
glibc-nss-devel
glibc-locale-source
glibc-locale-archive
glibc-devel
glibc-debugutils
glibc-debugsource
glibc-debuginfo
glibc-common
glibc-all-langpacks

Install security update from vendor's website.

GNU C Library (glibc) - update to 2.45
glibc - update to 2.38-124
glibc-help - update to 2.38-124
nss_modules - update to 2.38-124
nscd - update to 2.38-124
libnsl - update to 2.38-124
glibc-nss-devel - update to 2.38-124
glibc-locale-source - update to 2.38-124
glibc-locale-archive - update to 2.38-124
glibc-devel - update to 2.38-124
glibc-debugutils - update to 2.38-124
glibc-debugsource - update to 2.38-124
glibc-debuginfo - update to 2.38-124
glibc-common - update to 2.38-124
glibc-all-langpacks - update to 2.38-124

• https://www.openwall.com/lists/oss-security/2026/09/14/31
• https://sourceware.org/git/?p=glibc.git;a=commit;h=b090cf226ff65b913e41536f1f573f500855615c

• Multiple vulnerabilities in GNU C Library
• openEuler 24.03 LTS SP3 update for glibc
• openEuler 24.03 LTS SP1 update for glibc