CVE-2019-6488

Name: CVE-2019-6488
Creator: NVD / NIST
Published: 2019-01-18T19:29:00.2+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

UnknownEPSS 0.44%

Last modified Jun 17, 2026

CVE-2019-6488 is a vulnerability of currently unknown severity. The string component in the GNU C Library (aka glibc or libc6) through 2.28, when running on the x32 architecture, incorrectly attempts to use a 64-bit register for size_t in assembly codes, which can lead to a segmentation fault or possibly unspecified other impact, as demonstrated by a crash in __memmove_avx_unaligned_erms in sysdeps/x86_64/multiarch/memmove-vec-unaligned-erms.S during a memcpy.. EPSS estimates a 0.44% chance of exploitation in the next 30 days.

Description

The string component in the GNU C Library (aka glibc or libc6) through 2.28, when running on the x32 architecture, incorrectly attempts to use a 64-bit register for size_t in assembly codes, which can lead to a segmentation fault or possibly unspecified other impact, as demonstrated by a crash in __memmove_avx_unaligned_erms in sysdeps/x86_64/multiarch/memmove-vec-unaligned-erms.S during a memcpy.

Metrics

EPSS Probability

0.44%

34.8th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-404

Affected Software

Vendor	Product	Versions
Gnu	Glibc	<= 2.28

References

http://www.securityfocus.com/bid/106671Third Party Advisory
https://security.gentoo.org/glsa/202006-04
https://sourceware.org/bugzilla/show_bug.cgi?id=24097Issue Tracking, Third Party Advisory
http://www.securityfocus.com/bid/106671Third Party Advisory
https://security.gentoo.org/glsa/202006-04
https://sourceware.org/bugzilla/show_bug.cgi?id=24097Issue Tracking, Third Party Advisory

Timeline

Published: Jan 18, 2019
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2019-6488?

How severe is CVE-2019-6488?

Severity scoring for CVE-2019-6488 is pending analysis. The EPSS model estimates a 0.44% probability of exploitation in the next 30 days.

How do I fix CVE-2019-6488?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2019-6488?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST