Bug 2523258 (CVE-2026-19499)

Summary: CVE-2026-19499 glibc: Buffer Overflow in strfmon right-justification padding
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: akhatavk, aos-team-art-private, asdas, ashankar, codonell, dj, dpaolell, fweimer, jdelft, jupierce, lgarciaa, mbiarnes, pfrankli, ppalepu, ppostler, prdhamdh, rhel-process-autobot, sghai, sidsharm, suppawar, vlaad, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in glibc. The strfmon and strfmon_l functions are vulnerable to a buffer overflow when processing right-justified width padding. This occurs because an incorrect length is used for an internal memory operation, causing data to be written beyond its intended buffer. An attacker could exploit this by providing specially crafted input, potentially leading to arbitrary code execution or other severe impacts.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2523259, 2523260, 2523261    
Bug Blocks:    

Description OSIDB Bzimport 2026-08-25 07:36:13 UTC 
Summary: Buffer Overflow in strfmon right-justification padding:  <br/>
out-of-bounds write in the caller-supplied output buffer caused by using  <br/>
the post-padding length for the in-place `memmove`.<br/>
Requirements to exploit: A reachable application code path must invoke  <br/>
`strfmon` or `strfmon_l` with right-justified width padding and a  <br/>
destination buffer that is large enough for `__printf_buffer_pad` to  <br/>
succeed but not large enough for the subsequent overlong `memmove`. This  <br/>
may arise through attacker-influenced formatting input or through a fixed  <br/>
susceptible formatting pattern in the calling application.<br/>