Skip to main content

Ubuntu (unknown) CVE-2026-19499

| EUVDEUVD-2026-77675 HIGH
Heap-based Buffer Overflow (CWE-122)
2026-08-27 vendor:ubuntu GHSA-3vcj-mghm-mw9p
Buffer Overflow Heap Overflow
7.7
CVSS 3.1 · Vendor: vendor:ubuntu
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Unknown
  2. Exploit
    Unknown
  3. Impact
    Unknown

Vulnerability Assessment

Weakness
CWE
CWE-122
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK

1 technique across 1 tactic: Execution

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Exploitation conditions are entirely unknown - no description, CVSS vector, or technical details are available. Authentication requirements, attack vector, required configuration, and user interaction cannot be determined from the provided data. Monitor Ubuntu's security advisories for disclosure.
Impact

Risk cannot be assessed. No CVSS vector, EPSS score, KEV status, POC availability, or CWE is present in the input data. The only known fact is that Ubuntu has reported this CVE. Without description, severity scoring, or exploitation signals, this CVE should be treated as unclassified pending vendor disclosure. Security teams should monitor Ubuntu Security Notices (USN) for publication of advisory details.
Exploit ScenarioDerived

No exploit scenario can be constructed. The vulnerability description, attack vector, and impact are entirely unknown. No POC or KEV data exists in the provided intelligence.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.4% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Aug 27, 2026

CVE-2026-19499 has been reported by Ubuntu but contains no available description, CVSS score, vector, or CWE data at time of analysis. The vulnerability's nature, affected component, and impact are entirely unknown from the provided intelligence. No meaningful characterization of this CVE is possible without additional data from the vendor advisory or NVD.

RemediationAI

No remediation guidance is possible at this time. No patch version, workaround, or vendor advisory URL is present in the provided data. Monitor ubuntu.com/security/notices and the Ubuntu CVE tracker at ubuntu.com/security/cve/CVE-2026-19499 for updated guidance. Until an advisory is published, no specific compensating controls can be recommended without knowing the affected component.

Affected VersionsENISA

glibc 2.38 ≤2.44

Affected Packages

euvd glibc no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

No technical context is available. The sole intelligence signal is a vendor:ubuntu reporter attribution. The affected Ubuntu package, version range, underlying library or protocol, and root cause class (CWE) are all undisclosed. Analysis cannot proceed without a CVE description or vendor advisory.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (vendor:ubuntu) PRIMARY 7.7 HIGH
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:H
SUSE 6.1 MEDIUM
AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:H
Red Hat 6.8 MEDIUM

Primary rating from Vendor (vendor:ubuntu).

CVSS VectorVendor: vendor:ubuntu

Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
Low
Availability
High

Lifecycle Timeline

1
CVSS changed
Sep 14, 2026 - 18:37 NVD
7.7 (HIGH)

DescriptionCVE.org

[Unknown description]

Threat Intelligence Overview

EPSS Score
0.4%
Top 69% exploitable
Data Quality
5 sources
Confidence: Medium
EUVD NVD CVE.org EPSS MSRC Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.4%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Open
Automatable· derived
No
Human Impact· derived
Medium

Priority Score

38
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +38
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Heap Overflow HIGH

A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.

Same weakness CWE-122 – Heap-based Buffer Overflow

View all
CVE-2023-4911 HIGH POC
7.8
CVE-2023-27997 CRITICAL
9.8
CVE-2026-94127 CRITICAL POC
9.3
CVE-2025-25249 CRITICAL POC
9.8
CVE-2026-85880 HIGH POC
7.8
CVE-2025-24985 HIGH POC
7.8
CVE-2026-53362 HIGH POC
7.8
CVE-2025-21418 HIGH
7.8

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SLES15-SP5-CHOST-BYOS-SAP-CCloud Affected
SLES15-SP6-CHOST-BYOS Affected
SLES15-SP6-CHOST-BYOS-Aliyun Affected
SLES15-SP6-CHOST-BYOS-Azure Affected
SLES15-SP6-CHOST-BYOS-EC2 Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-19499 ADVISORY https://seclists.org/oss-sec/2026/q3/781 ADVISORY https://ubuntu.com/security/notices/USN-8737-1 ADVISORY https://vuldb.com/vuln/403624 REF https://sourceware.org/bugzilla/show_bug.cgi?id=34510 REF https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0017

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy