The GNU C Library security advisories update for 2026-09-14
glibc advisory GLIBC-SA-2026-0017 discloses a buffer overflow in strfmon/strfmon_l affecting versions 2.38 through 2.44.
The GNU C Library published security advisories including GLIBC-SA-2026-0017, a buffer overflow in strfmon and strfmon_l. Calling these functions with right-justified width padding conversions can write past the end of the caller-supplied output buffer in glibc 2.38 to 2.44. Exploitation requires an application code path that calls strfmon with attacker-influenced parameters.
- Buffer overflow in strfmon and strfmon_l right-justification padding
- Affects glibc versions 2.38 through 2.44
- Exploitation requires app path calling strfmon with crafted conversion specs
Posted by Adhemerval Zanella Netto on Sep 14 The following security advisories have been published: GLIBC-SA-2026-0017: =================== Buffer overflow in strfmon and strfmon_l right-justification padding Calling strfmon and strfmon_l in the GNU C Library version 2.38 to 2.44 can write past the end of the caller-supplied output buffer when a conversion uses right-justified width padding. Exploitation requires an application code path that calls strfmon or strfmon_l with...
This source does not provide full text. Read it at seclists.org.