https://seclists.org/oss-sec/2026/q3/781: The GNU C Library security advisories update for 2026-09-14

Q: Which applications are affected in practice?

Applications using GNU C Library versions 2.38 through 2.44 are affected only if they call strfmon or strfmon_l with right-justified width padding and use a destination buffer that can hold the padding but is too small for the internal memmove operation. The susceptible field width or format may be attacker-controlled or may be a fixed pattern in the application.

Q: Is there known network-facing exposure?

At the time of publication, no network-facing application impact was known. Exploitation still depends on reaching a susceptible application code path and supplying or triggering the relevant formatting conditions.

Q: How can we determine whether our code is exposed?

Review uses of strfmon and strfmon_l for format conversions with right-justified width padding. Verify that caller-supplied output buffers are sufficiently sized not only for the padding to succeed, but also for the internal memmove operation; GNU C Library 2.45 contains the listed fix.

Published Sep 14, 2026

Updated

Affected Software

3 affected components

GNU GNU C Library (glibc)>=2.38<=2.44

GNU GNU C Library (glibc)>=2.1<=2.44

GNU GNU C Library (glibc)>=2.3<=2.44

Frequently Asked Questions

Which applications are affected in practice?

Applications using GNU C Library versions 2.38 through 2.44 are affected only if they call strfmon or strfmon_l with right-justified width padding and use a destination buffer that can hold the padding but is too small for the internal memmove operation. The susceptible field width or format may be attacker-controlled or may be a fixed pattern in the application.

Is there known network-facing exposure?

At the time of publication, no network-facing application impact was known. Exploitation still depends on reaching a susceptible application code path and supplying or triggering the relevant formatting conditions.

How can we determine whether our code is exposed?

Review uses of strfmon and strfmon_l for format conversions with right-justified width padding. Verify that caller-supplied output buffers are sufficiently sized not only for the padding to succeed, but also for the internal memmove operation; GNU C Library 2.45 contains the listed fix.