Bug 2523260

Summary: CVE-2026-19499 zig: Buffer Overflow in strfmon right-justification padding [epel-all]
Product: [Fedora] Fedora EPEL Reporter: Srikanth Balasubramanian <sbalasub>
Component: zigAssignee: Jan Drögehoff <sentrycraft123>
Status: CLOSED NOTABUG QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: epel10CC: alebastr89, baltevl, josherna, marko03kostic, purin21345, renich, sentrycraft123, suraj.ghimire7
Target Milestone: ---Keywords: Security, SecurityTracking
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard: {"flaws": ["11a1e9f6-bd1a-4251-bbfa-f712a1a08b3f"]}
Fixed In Version: Doc Type: ---
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2026-09-05 11:04:22 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 2523258    

Description Srikanth Balasubramanian 2026-08-25 07:39:09 UTC 
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

Summary: Buffer Overflow in strfmon right-justification padding:  <br/>
out-of-bounds write in the caller-supplied output buffer caused by using  <br/>
the post-padding length for the in-place `memmove`.<br/>
Requirements to exploit: A reachable application code path must invoke  <br/>
`strfmon` or `strfmon_l` with right-justified width padding and a  <br/>
destination buffer that is large enough for `__printf_buffer_pad` to  <br/>
succeed but not large enough for the subsequent overlong `memmove`. This  <br/>
may arise through attacker-influenced formatting input or through a fixed  <br/>
susceptible formatting pattern in the calling application.<br/>
Comment 1 Renich Bon Ciric 2026-09-05 11:04:22 UTC 
Zig is not affected by this vulnerability.

While `zig.spec` declares `Provides: bundled(glibc) = 2.43` to account for embedded headers and ABI symbol metadata, Zig does not bundle or compile the GNU C Library implementation of the affected routine.

Specifically:
- Zig only ships glibc ABI symbol tables (`abilists`) to generate compile-time dynamic linking stubs (`.so`), generic headers, and minimal C runtime startup objects (`crt1.o`, `elf-init`, `stat` shims).
- Zig compiler binaries and generated executables dynamically link against the host/target system's runtime `libc.so.6`.

Closing as NOTABUG.