[Bug locale/34510] New: Buffer overflow in strfmon right-justification padding (CVE-2026-19499)

https://sourceware.org/bugzilla/show_bug.cgi?id=34510

            Bug ID: 34510
           Summary: Buffer overflow in strfmon right-justification padding
                    (CVE-2026-19499)
           Product: glibc
           Version: unspecified
            Status: NEW
          Severity: normal
          Priority: P2
         Component: locale
          Assignee: unassigned at sourceware dot org
          Reporter: fweimer at redhat dot com
  Target Milestone: ---
             Flags: security+

Created attachment 16924
  --> https://sourceware.org/bugzilla/attachment.cgi?id=16924&action=edit
RHEL-214908.html

Red Hat Product Security has requested that I report the attached vulnerability
report upstream.

The glibc security team has assigned CVE-2026-19499 to this issue and requested
that it shall be disclosed publicly (no embargo).

Proper test case:

#include <monetary.h>
#include <errno.h>
#include <support/check.h>
#include <support/next_to_fault.h>

static int
do_test (void)
{
  struct support_next_to_fault ntf = support_next_to_fault_allocate (100);
  TEST_COMPARE (strfmon (ntf.buffer, ntf.length, "%100n", 1.23), -1);
  TEST_COMPARE (errno, E2BIG);
  return 0;
}

#include <support/test-driver.c>

I've been advised to mention: Found by AISLE in partnership with Red Hat

-- 
You are receiving this mail because:
You are on the CC list for the bug.