# CVE-2026-19499: GNU C Library buffer overflow in strfmon right-justification

Source: https://junglewise.ai/threats/cve-2026-19499-gnu-c-library-buffer-overflow-in-strfmon-right-justification  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-14. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-19499 · Severity: high · CVSS 7.7 · Published 2026-09-14

The GNU C Library's strfmon and strfmon_l functions, used by applications to format monetary values, can write past the end of output buffers when processing right-justified width padding. An attacker who can control format strings or width values in an application using these functions could cause memory corruption, potentially leading to data exposure or application crashes. No active exploitation in the wild has been reported at this time.

Technologies: [Gnu C Library](https://junglewise.ai/threats/technologies/c-library). Vendors: [Gnu](https://junglewise.ai/threats/vendors/gnu).

## Quick answers

**Is CVE-2026-19499 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-19499 being exploited in the wild.

**How severe is CVE-2026-19499?** High severity, with a CVSS score of 7.7, published 14 September 2026.

**Which products and versions are affected?** Gnu C Library 2.38 to 2.44.

**Is there a fix for CVE-2026-19499?** A patch was published on 2026: Fix available in glibc 2.45 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-19499 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-19499?** Check whether you run Gnu C Library at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is a heap buffer overflow in the strfmon/strfmon_l monetary formatting functions affecting glibc versions 2.38 through 2.44. The vulnerability occurs during right-justified width padding operations where an internal memmove call writes beyond the bounds of the caller-supplied output buffer. Exploitation requires an application code path that calls strfmon with right-justified width padding into a buffer that is large enough for the padding computation but too small for the memmove operation. Attack preconditions include the ability to influence format strings or field width values, or exploiting fixed susceptible patterns in the calling application. The vulnerability results in out-of-bounds writes that can corrupt heap memory. A patch has been committed in glibc 2.45 (fix commit b090cf226ff65b913e41536f1f573f500855615c).

## Affected products

- GNU C Library 2.38 to 2.44

## Timeline

- 2026-08-11: disclosed
- 2026: patched: Fix available in glibc 2.45

## References

- [https://sourceware.org/bugzilla/show_bug.cgi?id=34510](https://sourceware.org/bugzilla/show_bug.cgi?id=34510)
- [https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0017](https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0017)

## Related threats

- [GNU C Library BIG-HKSCS character encoding hang on crafted input](https://junglewise.ai/threats/cve-2026-122054-converting-crafted-big-hkscs-input-to-ucs-4-or-the-internal-wide)
- [GNU C Library gettext directory traversal in LANGUAGE variable](https://junglewise.ai/threats/cve-2026-84243-the-gettext-family-of-functions-in-the-gnu-c-library-version-2-0)
- [GNU C Library DNS resolver assertion failure in search list parsing](https://junglewise.ai/threats/cve-2026-8674-gnu-c-library-dns-resolver-assertion-failure-in-search-list)
- [GNU C Library EUC_JISX0213 converter denial of service](https://junglewise.ai/threats/cve-2026-80489-gnu-c-library-euc-jisx0213-converter-denial-of-service)
- [GNU C Library tdelete stack-based buffer overflow](https://junglewise.ai/threats/cve-2026-19542-gnu-c-library-tdelete-stack-based-buffer-overflow)