Glibc flags buffer overflow in strfmon monetary formatting

The GNU C Library has published an advisory for CVE-2026-19499, a buffer overflow in the strfmon and strfmon_l monetary formatting functions affecting versions 2.38 through 2.44.

The flaw can write past the end of a caller-supplied output buffer when a conversion uses right-justified width padding. Exploitation needs an application path that pads into a destination large enough for the padding to succeed but too small for an internal move of the result. The field width or format string may be attacker-influenced, or a fixed pattern in the caller may be enough.

Glibc rates the issue CVSS 7.7 and says that at publication no network-facing application impact is known. The bug was reported by AISLE in partnership with Red Hat. The fix shipped in glibc 2.45. Adhemerval Zanella published the advisory on the libc-alpha list.