CVE-2026-19499
CVE-2026-19499: 1 tracked advisory record across Red Hat. Compare vendor sources and published fix guidance.
Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.
Vendor advisory comparison
Red Hat
1 advisory- Advisory severityMedium6.8
Medium [CVE-2026-19499] Buffer Overflow in strfmon right-justification padding
CVE-2026-19499Source published Source updated
Calling strfmon and strfmon_l in the GNU C Library version 2.38 to 2.44 can write past the end of the caller-supplied output buffer when a conversion uses right-justified width padding. Exploitation requires an application code path that calls strfmon or strfmon_l with right-justified width padding into a destination buffer that is large enough for the padding to succeed but too small for the internal memmove call. The field width or format may be attacker-influenced or a fixed susceptible pattern in the caller. At the time of publication, no network-facing application impact is known. A flaw was found in glibc. This occurs because an incorrect length is used for an internal memory operation, causing data to be written beyond its intended buffer. An attacker could exploit this by…
- Affected products in this advisory
- Red Hat Hardened Images
- Red Hat Enterprise Linux 10
- Red Hat package: glibc
- Source-reported affected versions
- Affected-version details not available in this record.
- Source-reported fixed versions
- glibc-main-2.43-8.3.hum1
- RHSA-2026:60865
- Mitigation guidance
- This issue is reachable only through applications that call glibc strfmon or strfmon_l with right-justified width padding into an undersized destination buffer. Prefer avoiding those APIs, or ensure destination buffers are sized for the full formatted result including padding. Where monetary formatting is exposed to untrusted input, restrict access to trusted clients.
Android app · Google Play
Monitor future Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.