glibc 2.38–2.44 strfmon()/strfmon_l() can write past a caller-supplied output buffer when a conversion uses right-justified width padding, triggering an internal memmove overflow if the destination fits padding but not the move. Exploitation needs a code path using attacker-influenced width/format. Upgrade glibc outside 2.38–2.44 per vendor advisory.