Medium [CVE-2026-19499] Buffer Overflow in strfmon right-justification padding

Calling strfmon and strfmon_l in the GNU C Library version 2.38 to 2.44 can write past the end of the caller-supplied output buffer when a conversion uses right-justified width padding.

Exploitation requires an application code path that calls strfmon or strfmon_l with right-justified width padding into a destination buffer that is large enough for the padding to succeed but too small for the internal memmove call. The field width or format may be attacker-influenced or a fixed susceptible pattern in the caller.

At the time of publication, no network-facing application impact is known. A flaw was found in glibc.

This occurs because an incorrect length is used for an internal memory operation, causing data to be written beyond its intended buffer. An attacker could exploit this by providing specially crafted input, potentially leading to arbitrary code execution or other severe impacts.

This Moderate impact buffer overflow in `strfmon` or `strfmon_l` within glibc occurs when an application uses right-justified width padding with a specific buffer size, leading to an out-of-bounds write.

Exploitation requires a vulnerable application code path that processes attacker-controlled formatting input or uses a fixed susceptible formatting pattern, limiting its general exploitability in typical Red Hat deployments.