CVE-2026-97399

LOW 3.7

One-byte overread in strncasecmp on Power8

CVSS Score

3.7

EPSS Score

0.0%

EPSS Percentile

0th

The strncasecmp function in the GNU C Library 2.24 and later optimized for the Power8 architecture may read one byte beyond the input size limit, which may crash a program when that byte is not readable. This condition may happen when the input strings to the strncasecmp function are attacker controlled in an application and they match all the way up to the edge of their page and the neighbouring page is either not mapped or is not readable.

CWE	CWE-126
Vendor	the gnu c library
Product	glibc
Published	Sep 28, 2026

Stay Ahead of the Next One

Get instant alerts for the gnu c library glibc

Be the first to know when new low vulnerabilities affecting the gnu c library glibc are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Affected Versions

The GNU C Library / glibc

2.24 < 2.45

References

NVD ↗ CVE.org ↗ EPSS Data ↗

sourceware.org: https://sourceware.org/bugzilla/show_bug.cgi?id=34683 sourceware.org: https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0024

Credits

AISLE in partnership with Red Hat