USN-8737-1: GNU C Library vulnerabilities
Ubuntu patches GNU C Library flaws including a strfmon buffer overflow and tdelete out-of-bounds access that could enable code execution.
Ubuntu issued USN-8737-1 fixing multiple GNU C Library vulnerabilities. CVE-2026-19499 is a buffer overflow in the strfmon function when handling right-justification padding, affecting only Ubuntu 26.04 LTS. CVE-2026-19542 is an out-of-bounds stack array access in the tdelete function. An additional issue involves incorrect memory handling in wordexp with the WRDE_APPEND flag. All issues could potentially cause denial of service or arbitrary code execution.
- CVE-2026-19499: strfmon buffer overflow, affects Ubuntu 26.04 LTS only
- CVE-2026-19542: tdelete out-of-bounds stack array access
- Issues could cause denial of service or arbitrary code execution
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-19499+1 related CVE | Buffer overflow in glibc strfmon() width padding affects glibc 2.38–2.44 | 7.7 group max | — |
From the original article
It was discovered that GNU C Library had a buffer overflow in the strfmon function when handling right-justification padding. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 26.
ubuntu.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.