Story · 1 source · 1 articlefirst Sep 8, 15:17 UTCupdated Sep 8, 15:17 UTC (8d ago)1

Ubuntu patches glibc strfmon/tdelete flaws (CVE-2026-19499, CVE-2026-19542); upstream advisories GLIBC-SA-2026-0016/-0017 add nscd crash and strfmon version details

mediumVulnerabilityimportance 38CVE-2026-19499 CVE-2026-19542

What's new: New since the previous summary (written 2026-09-11): the glibc advisories update for 2026-09-14 published GLIBC-SA-2026-0017, disclosing a buffer overflow in strfmon and strfmon_l affecting glibc versions 2.38 through 2.44 when right-justified width padding conversions write past the caller-supplied output buffer; exploitation requires an application path calling strfmon with attacker-influenced…

Merged summary · glm-5.3 · rewritten as coverage arrives

Ubuntu USN-8737-1 (26.04 LTS) and USN-8737-2 (24.04 LTS) patch glibc CVE-2026-19499 (strfmon buffer overflow) and CVE-2026-19542 (tdelete out-of-bounds access); upstream glibc advisories disclose an nscd stack overflow (GLIBC-SA-2026-0016) and a…

Ubuntu Security Notice USN-8737-1, published 2026-09-08, fixed multiple GNU C Library (glibc) vulnerabilities. CVE-2026-19499 is a buffer overflow in the strfmon function when handling right-justification padding; per USN-8737-1 it affects only Ubuntu 26.04 LTS. CVE-2026-19542 is an out-of-bounds stack array access in the tdelete function. USN-8737-1 also mentions an additional issue involving incorrect memory handling in wordexp with the WRDE_APPEND flag (no CVE id given in the reports). All of these issues could potentially cause denial of service or arbitrary code execution. USN-8737-2, published 2026-09-10, delivers the same glibc fixes (CVE-2026-19499 and CVE-2026-19542) to Ubuntu 24.04 LTS, with the same stated impact. Separately, the glibc security advisory update for 2026-09-10, posted to oss-security on 2026-09-11 by glibc maintainer Siddhesh Poyarekar, published GLIBC-SA-2026-0016: a stack overflow in the nscd service caused by unbounded alloca use. nscd in glibc 2.3.4 and newer can crash when a malicious DNS server returns an oversized response to DNS queries, degrading DNS resolution; exploitation requires nscd to be enabled and the system to be using an untrusted DNS server. No CVE id is assigned to the nscd issue in the reports, and no report ties GLIBC-SA-2026-0016 to the Ubuntu USN-8737 notices. The glibc advisories update for 2026-09-14, posted to oss-security, then published GLIBC-SA-2026-0017: a buffer overflow in strfmon and strfmon_l, where calling these functions with right-justified width padding conversions can write past the end of the caller-supplied output buffer in glibc versions 2.38 through 2.44. Exploitation requires an application code path that calls strfmon with attacker-influenced parameters. The description of GLIBC-SA-2026-0017 closely matches CVE-2026-19499 (strfmon right-justification padding buffer overflow), but the reports do not explicitly link the two identifiers, so the correspondence is inferred rather than stated. The sources are otherwise consistent on the CVE descriptions and impact; the scoping nuance is that USN-8737-1 states CVE-2026-19499 affects only Ubuntu 26.04 LTS, while USN-8737-2 extends the fixes to Ubuntu 24.04 LTS.

USN-8737-1 published 2026-09-08 fixes CVE-2026-19499 and CVE-2026-19542 in Ubuntu 26.04 LTS; the notice states CVE-2026-19499 affects only Ubuntu 26.04 LTS
CVE-2026-19499: buffer overflow in strfmon when handling right-justification padding
CVE-2026-19542: out-of-bounds stack array access in the tdelete function
USN-8737-1 also fixes incorrect memory handling in wordexp with the WRDE_APPEND flag; no CVE id given in the reports
USN-8737-2 published 2026-09-10 delivers the same glibc fixes to Ubuntu 24.04 LTS
All USN-8737 issues could potentially cause denial of service or arbitrary code execution
GLIBC-SA-2026-0016: stack overflow in nscd via unbounded alloca use; nscd in glibc 2.3.4 and newer can crash when a malicious DNS server returns an oversized response, degrading DNS resolution
GLIBC-SA-2026-0016 requires nscd to be enabled and the system to use an untrusted DNS server; no CVE id assigned in the reports

VendorsGNU C Library Canonical Ubuntu GNU

Productsglibc nscd GNU C Library strfmon tdelete

OrganizationsGNU Project

Coverage timelineoldest first · each row is one article

Sep 8, 15:17 UTC · 8d ago
Ubuntu Security Notices· 25
USN-8737-1: GNU C Library vulnerabilities
Ubuntu patches GNU C Library flaws including a strfmon buffer overflow and tdelete out-of-bounds access that could enable code execution.

Vulnerabilities in this storyAll →

CVE	Vulnerability	CVSS	EPSS	Flags	Affected	Exposure	Published
CVE-2026-19499	Buffer overflow in glibc strfmon() width padding affects glibc 2.38–2.44 The strfmon() and strfmon_l() functions in the GNU C Library (glibc) versions 2.38 through 2.44 can write past the end of a caller-supplied buffer when a monetary conversion uses right-justified width padding. The overflow occurs when the destination buffer is large enough for the padding itself but too small for an internal memmove operation, with the field width or format string potentially attacker-influenced or a fixed susceptible pattern in the calling code. Successful exploitation yields out-of-bounds memory writes in the context of the calling application, plausibly causing crashes (denial of service) or, depending on heap layout, code execution. Any Linux application linked against glibc 2.38–2.44 that calls strfmon/strfmon_l with such patterns is affected, though no network-facing application impact was known at publication. No public proof of concept or in-the-wild exploitation has been reported, and the issue is not on the CISA KEV list. Do: Apply your distribution's patched glibc packages (e.g., Ubuntu USN-8737-1 / USN-8737-2) or upgrade to a glibc release newer than 2.44, then restart long-running services so they relink against the fixed library. Audit internally developed software for calls to strfmon/strfmon_l with right-justified width padding, especially where monetary format strings or field widths derive from user input, and sanitize or cap those inputs in the interim. Since no network-facing impact is known, prioritize this as routine patching rather than emergency response, but track vendor advisories for newly identified vulnerable applications.	7.7	—		GNU Project GNU C Library (glibc) 2.38 to 2.44	massglibc ships on essentially every Linux system (plausibly >1 billion installations), but the set of applications with a vulnerable strfmon call path is unknown…	2d ago
CVE-2026-19542	Stack Buffer Overflow in GNU C Library (glibc) tdelete on Deep Trees A stack-based buffer overflow (CWE-121) exists in the tdelete function of the GNU C Library versions 2.1 through 2.44, where two rebalancing branches push an entry onto an internal parent-node stack without checking capacity, writing one pointer past the end of an alloca-allocated array. Triggering it requires deleting a node at a depth of exactly 40 (or 40 plus a multiple of 20), which implies a tree of at least a million nodes, meaning an attacker would need to drive a very large number of insertions and deletions through an application that uses tsearch/tdelete. The written value is a pointer into a tree node and is not directly attacker controlled, so the most likely outcome is an application crash (low confidentiality/integrity/availability impact per the CVSS 5.6 rating). No affected application in common Linux distributions has been identified, significantly limiting real-world attack surface. No public proof of concept exists and the flaw is not in the CISA KEV catalog. Do: Apply distribution security updates for glibc as they ship (Ubuntu has published USN-8737-1 and USN-8737-2 covering this issue) rather than waiting for a targeted exploit. Audit any in-house or third-party applications that use tsearch/tdelete on attacker-influenced data, and confirm they cannot accumulate trees of a million or more nodes. Because the written value is not attacker controlled, the primary risk is denial of service via crash, so prioritize patching on long-running services that maintain large search trees.	5.6	—		GNU Project GNU C Library (glibc) 2.1 through 2.44	masshundreds of millions of Linux systems (glibc ships as the default C library on nearly all major distributions), though realistically exploitable applications…	2d ago

CVE

Vulnerability

CVSS

EPSS

Flags

Affected

Exposure

Published

CVE-2026-19499

Buffer overflow in glibc strfmon() width padding affects glibc 2.38–2.44

The strfmon() and strfmon_l() functions in the GNU C Library (glibc) versions 2.38 through 2.44 can write past the end of a caller-supplied buffer when a monetary conversion uses right-justified width padding. The overflow occurs when the destination buffer is large enough for the padding itself but too small for an internal memmove operation, with the field width or format string potentially attacker-influenced or a fixed susceptible pattern in the calling code. Successful exploitation yields out-of-bounds memory writes in the context of the calling application, plausibly causing crashes (denial of service) or, depending on heap layout, code execution. Any Linux application linked against glibc 2.38–2.44 that calls strfmon/strfmon_l with such patterns is affected, though no network-facing application impact was known at publication. No public proof of concept or in-the-wild exploitation has been reported, and the issue is not on the CISA KEV list.

Do: Apply your distribution's patched glibc packages (e.g., Ubuntu USN-8737-1 / USN-8737-2) or upgrade to a glibc release newer than 2.44, then restart long-running services so they relink against the fixed library. Audit internally developed software for calls to strfmon/strfmon_l with right-justified width padding, especially where monetary format strings or field widths derive from user input, and sanitize or cap those inputs in the interim. Since no network-facing impact is known, prioritize this as routine patching rather than emergency response, but track vendor advisories for newly identified vulnerable applications.

7.7

—

GNU Project GNU C Library (glibc) 2.38 to 2.44

massglibc ships on essentially every Linux system (plausibly >1 billion installations), but the set of applications with a vulnerable strfmon call path is unknown…

2d ago

CVE-2026-19542

Stack Buffer Overflow in GNU C Library (glibc) tdelete on Deep Trees

A stack-based buffer overflow (CWE-121) exists in the tdelete function of the GNU C Library versions 2.1 through 2.44, where two rebalancing branches push an entry onto an internal parent-node stack without checking capacity, writing one pointer past the end of an alloca-allocated array. Triggering it requires deleting a node at a depth of exactly 40 (or 40 plus a multiple of 20), which implies a tree of at least a million nodes, meaning an attacker would need to drive a very large number of insertions and deletions through an application that uses tsearch/tdelete. The written value is a pointer into a tree node and is not directly attacker controlled, so the most likely outcome is an application crash (low confidentiality/integrity/availability impact per the CVSS 5.6 rating). No affected application in common Linux distributions has been identified, significantly limiting real-world attack surface. No public proof of concept exists and the flaw is not in the CISA KEV catalog.

Do: Apply distribution security updates for glibc as they ship (Ubuntu has published USN-8737-1 and USN-8737-2 covering this issue) rather than waiting for a targeted exploit. Audit any in-house or third-party applications that use tsearch/tdelete on attacker-influenced data, and confirm they cannot accumulate trees of a million or more nodes. Because the written value is not attacker controlled, the primary risk is denial of service via crash, so prioritize patching on long-running services that maintain large search trees.

5.6

—

GNU Project GNU C Library (glibc) 2.1 through 2.44

masshundreds of millions of Linux systems (glibc ships as the default C library on nearly all major distributions), though realistically exploitable applications…

2d ago