RHSA-2026:60865MediumCVSS 6.8

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Published
August 29, 2026
Last Modified
October 8, 2026

🔗 CVE IDs covered (1)

CVE-2026-19499 →

📋 Description

CVE-2026-19499 — glibc: Buffer Overflow in strfmon right-justification padding

🎯 Affected products200

  • Red Hat Hardened Images
  • compat-libpthread-nonshared-0:2.43-8.3.hum1@aarch64 as a component of Red Hat Hardened Images
  • compat-libpthread-nonshared-0:2.43-8.3.hum1@x86_64 as a component of Red Hat Hardened Images
  • glibc-0:2.43-8.3.hum1@aarch64 as a component of Red Hat Hardened Images
  • glibc-0:2.43-8.3.hum1@src as a component of Red Hat Hardened Images
  • glibc-0:2.43-8.3.hum1@x86_64 as a component of Red Hat Hardened Images
  • glibc-all-langpacks-0:2.43-8.3.hum1@aarch64 as a component of Red Hat Hardened Images
  • glibc-all-langpacks-0:2.43-8.3.hum1@x86_64 as a component of Red Hat Hardened Images
  • glibc-benchtests-0:2.43-8.3.hum1@aarch64 as a component of Red Hat Hardened Images
  • glibc-benchtests-0:2.43-8.3.hum1@x86_64 as a component of Red Hat Hardened Images
  • glibc-common-0:2.43-8.3.hum1@aarch64 as a component of Red Hat Hardened Images
  • glibc-common-0:2.43-8.3.hum1@x86_64 as a component of Red Hat Hardened Images
  • glibc-devel-0:2.43-8.3.hum1@aarch64 as a component of Red Hat Hardened Images
  • glibc-devel-0:2.43-8.3.hum1@x86_64 as a component of Red Hat Hardened Images
  • glibc-doc-0:2.43-8.3.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images
  • glibc-doc-0:2.43-8.3.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images
  • glibc-gconv-extra-0:2.43-8.3.hum1@aarch64 as a component of Red Hat Hardened Images
  • glibc-gconv-extra-0:2.43-8.3.hum1@x86_64 as a component of Red Hat Hardened Images
  • glibc-langpack-aa-0:2.43-8.3.hum1@aarch64 as a component of Red Hat Hardened Images
  • glibc-langpack-aa-0:2.43-8.3.hum1@x86_64 as a component of Red Hat Hardened Images
  • glibc-langpack-af-0:2.43-8.3.hum1@aarch64 as a component of Red Hat Hardened Images
  • glibc-langpack-af-0:2.43-8.3.hum1@x86_64 as a component of Red Hat Hardened Images
  • glibc-langpack-agr-0:2.43-8.3.hum1@aarch64 as a component of Red Hat Hardened Images
  • glibc-langpack-agr-0:2.43-8.3.hum1@x86_64 as a component of Red Hat Hardened Images
  • glibc-langpack-ak-0:2.43-8.3.hum1@aarch64 as a component of Red Hat Hardened Images
  • glibc-langpack-ak-0:2.43-8.3.hum1@x86_64 as a component of Red Hat Hardened Images
  • glibc-langpack-am-0:2.43-8.3.hum1@aarch64 as a component of Red Hat Hardened Images
  • glibc-langpack-am-0:2.43-8.3.hum1@x86_64 as a component of Red Hat Hardened Images
  • glibc-langpack-an-0:2.43-8.3.hum1@aarch64 as a component of Red Hat Hardened Images
  • glibc-langpack-an-0:2.43-8.3.hum1@x86_64 as a component of Red Hat Hardened Images
  • +170 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Workaround: This issue is reachable only through applications that call glibc strfmon or strfmon_l with right-justified width padding into an undersized destination buffer. Prefer avoiding those APIs, or ensure destination buffers are sized for the full formatted result including padding. Where monetary formatting is exposed to untrusted input, restrict access to trusted clients.

🔗 References (5)