Executive brief
The GNU C Library's strfmon and strfmon_l functions, used by applications to format monetary values, can write past the end of output buffers when processing right-justified width padding. An attacker who can control format strings or width values in an application using these functions could cause memory corruption, potentially leading to data exposure or application crashes. No active exploitation in the wild has been reported at this time.
Technical details
This is a heap buffer overflow in the strfmon/strfmon_l monetary formatting functions affecting glibc versions 2.38 through 2.44. The vulnerability occurs during right-justified width padding operations where an internal memmove call writes beyond the bounds of the caller-supplied output buffer. Exploitation requires an application code path that calls strfmon with right-justified width padding into a buffer that is large enough for the padding computation but too small for the memmove operation. Attack preconditions include the ability to influence format strings or field width values, or exploiting fixed susceptible patterns in the calling application. The vulnerability results in out-of-bounds writes that can corrupt heap memory. A patch has been committed in glibc 2.45 (fix commit b090cf226ff65b913e41536f1f573f500855615c).
Affected products
- GNU C Library 2.38 to 2.44
Timeline
- 2026-08-11: disclosed
- 2026: patched: Fix available in glibc 2.45