Quick answers
- Is CVE-2026-19499 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-19499 being exploited in the wild.
- How severe is CVE-2026-19499?
- High severity, with a CVSS score of 7.7, published 14 September 2026.
- Which products and versions are affected?
- Gnu C Library 2.38 to 2.44.
- Is there a fix for CVE-2026-19499?
- A patch was published on 2026: Fix available in glibc 2.45 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-19499 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-19499?
- Check whether you run Gnu C Library at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
This is a heap buffer overflow in the strfmon/strfmon_l monetary formatting functions affecting glibc versions 2.38 through 2.44. The vulnerability occurs during right-justified width padding operations where an internal memmove call writes beyond the bounds of the caller-supplied output buffer. Exploitation requires an application code path that calls strfmon with right-justified width padding into a buffer that is large enough for the padding computation but too small for the memmove operation. Attack preconditions include the ability to influence format strings or field width values, or exploiting fixed susceptible patterns in the calling application. The vulnerability results in out-of-bounds writes that can corrupt heap memory. A patch has been committed in glibc 2.45 (fix commit b090cf226ff65b913e41536f1f573f500855615c).
Affected products
- GNU C Library 2.38 to 2.44
Timeline
- 2026-08-11: disclosed
- 2026: patched: Fix available in glibc 2.45