CVE-2009-4881: Integer overflow in the __vstrfmon_l function in stdlib/strfmon_l.c in the strfmon implementation in the GN...

Security readout for executives and security teams

This is an old glibc bug where specially shaped monetary-format input can crash software that passes attacker-controlled format strings into strfmon_l. The impact shown in sources is denial of service, not data theft or code execution. It matters mainly for legacy Linux systems or appliances still running glibc before 2.10.1. Exposure is likely limited to legacy Linux distributions, embedded systems, or vendor appliances using glibc/libc6 earlier than 2.10.1 and applications that process untrusted monetary format strings through strfmon_l-related paths. Treat as a legacy exposure cleanup item unless a critical service still runs affected glibc and accepts untrusted formatting input. It is not shown as actively exploited in the provided sources, but crashes in exposed services can still create availability risk. Mitigation focus: Identify systems running glibc/libc6 earlier than 2.10.1.; Apply vendor glibc updates from the relevant Linux distribution advisory.; Check appliance vendor guidance if glibc versioning is hidden..

Prepared

Jun 28, 2026, 02:49 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.