CVE-2019-9192: In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion

highCVSS 7.5CVE-2019-9192

CSIRTS triage

vendor: GNU product: glibc Denial of service Code injectionaffected: through 2.29

What: Uncontrolled recursion in check_dst_limits_calc_pos_1 within POSIX regex execution allows stack exhaustion.
Who is affected: Systems running glibc through version 2.29 processing untrusted regular expressions.
Urgency: High priority; stack exhaustion can crash applications and potentially be chained for code execution.
Action: Upgrade glibc to version 2.30 or later with recursion depth limiting.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch glibc

Get an email when a new glibc advisory drops — max one per day, one-click unsubscribe.

Details

Source: Microsoft Security Response Center (INTL · vendor-psirt · site)
Severity: high — CVSS 7.5
Published: 2026-08-06
Exploitation: Not in CISA KEV at last sync

Original advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2019-9192

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Moderate exploitation riskCVE-2019-91922.4% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 83% of all EPSS-scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2019-9192	coverage & exploitation status	NVD · CVE.org

Recent advisories for In the GNU

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

unknownCVE-2026-16599: GNU wget is vulnerable to denial of service in its FTP OPIE/S-KEY authentication functionality…nvd · 2026-08-25
medium[NEW] [medium] GNU Emacs: Vulnerability allows information disclosure and DoScert-bund · 2026-08-24
highCVE-2026-77219: GNU Emacs before 31.0.91 contains an integer overflow in the PBM/PPM/PGM image loader that all…nvd · 2026-08-21
mediumCVE-2026-19548: Multiple Use-After-Free vulnerabilities were found in the add_archive_element function in ld/l…nvd · 2026-08-12
medium[NEW] [medium] GNU libc: Vulnerability enables Denial of Servicecert-bund · 2026-08-12
medium[UPDATE] [medium] GNU libc: Multiple vulnerabilitiescert-bund · 2026-08-12