DescriptionSrikanth Balasubramanian
2026-08-25 07:39:02 UTC
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Summary: Buffer Overflow in strfmon right-justification padding: <br/>
out-of-bounds write in the caller-supplied output buffer caused by using <br/>
the post-padding length for the in-place `memmove`.<br/>
Requirements to exploit: A reachable application code path must invoke <br/>
`strfmon` or `strfmon_l` with right-justified width padding and a <br/>
destination buffer that is large enough for `__printf_buffer_pad` to <br/>
succeed but not large enough for the subsequent overlong `memmove`. This <br/>
may arise through attacker-influenced formatting input or through a fixed <br/>
susceptible formatting pattern in the calling application.<br/>