The GNU C Library security advisories update for 2026-09-14
glibc advisory GLIBC-SA-2026-0017 discloses a buffer overflow in strfmon/strfmon_l affecting versions 2.38 through 2.44.
The GNU C Library published security advisories including GLIBC-SA-2026-0017, a buffer overflow in strfmon and strfmon_l. Calling these functions with right-justified width padding conversions can write past the end of the caller-supplied output buffer in glibc 2.38 to 2.44. Exploitation requires an application code path that calls strfmon with attacker-influenced parameters.
- Buffer overflow in strfmon and strfmon_l right-justification padding
- Affects glibc versions 2.38 through 2.44
- Exploitation requires app path calling strfmon with crafted conversion specs
From the original article
Posted by Adhemerval Zanella Netto on Sep 14 The following security advisories have been published: GLIBC-SA-2026-0017: =================== Buffer overflow in strfmon and strfmon_l right-justification padding Calling strfmon and strfmon_l in the GNU C Library version 2. 38 to 2. 44 can write past the end of the caller-supplied output buffer when a conversion uses right-justified width padding.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.