CVE-2025-5702
published 2025-06-05CVE-2025-5702: The strcmp implementation optimized for the Power10 processor in the GNU C Library version 2.39 and later writes to vector registers v20 to v31 without saving…
PriorityP428medium5.6CVSS 3.1
AVNACHPRNUINSUCLILAL
EPSS
0.25%
16.2th percentile
The strcmp implementation optimized for the Power10 processor in the GNU C Library version 2.39 and later writes to vector registers v20 to v31 without saving contents from the caller (those registers are defined as non-volatile registers by the powerpc64le ABI), resulting in overwriting of its contents and potentially altering control flow of the caller, or leaking the input strings to the function to other parts of the program.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | glibc | < glibc 2.41-9 (forky) | glibc 2.41-9 (forky) |
| gnu | glibc | >= 0 < 2.41-9 | 2.41-9 |
| gnu | glibc | >= 0 < 2.41-9 | 2.41-9 |
| gnu | glibc | >= 0 < 2.39-0ubuntu8.5 | 2.39-0ubuntu8.5 |
| gnu | glibc | >= 2.39 < 2.39-209 | 2.39-209 |
| gnu | glibc | >= 2.40 < 2.40-139 | 2.40-139 |
| gnu | glibc | >= 2.41 < 2.41-60 | 2.41-60 |
| msrc | azl3_mozjs_102.15.1-1_on_azure_linux_3.0 | — | — |
| the_gnu_c_library | glibc | — | — |
CVSS provenance
nvdv3.15.6MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
osv5.6MEDIUM
vendor_msrc7.5HIGH
vendor_debian5.6LOW
vendor_redhat5.6MEDIUM
vendor_ubuntu5.6MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
GNU C Library vulnerabilities
vendor_ubuntu·2025-07-14·CVSS 5.6
CVE-2025-5702 [MEDIUM] GNU C Library vulnerabilities
Title: GNU C Library vulnerabilities
Summary: Several security issues were fixed in GNU C Library.
It was discovered that the GNU C Library incorrectly handled the strcmp
implementation optimized for Power10 processors. This could cause
applications to crash, compute wrong results, or leak confidential
information. (CVE-2025-5702)
It was discovered that the GNU C Library incorrectly handled the strncmp
implementation optimized for Power10 processors. This could cause
applications to crash, compute wrong results, or leak confidential
information. This issue only affected Ubuntu 25.04. (CVE-2025-5745)
Instructions: After a standard system update you need to reboot your computer to make all
the necessary changes.
Red Hat
glibc: Vector register overwrite bug in glibc
vendor_redhat·2025-06-05·CVSS 5.6
CVE-2025-5702 [MEDIUM] CWE-404 glibc: Vector register overwrite bug in glibc
glibc: Vector register overwrite bug in glibc
The strcmp implementation optimized for the Power10 processor in the GNU C Library version 2.39 and later writes to vector registers v20 to v31 without saving contents from the caller (those registers are defined as non-volatile registers by the powerpc64le ABI), resulting in overwriting of its contents and potentially altering control flow of the caller, or leaking the input strings to the function to other parts of the program.
A flaw was found in the optimized strcmp glibc function for the Power10 CPU architecture. GNU C library versions from 2.39 onward overwrite two vector registers in a way that can disrupt the control flow of a program.
Statement: This flaw is marked as a Moderate vulnerability rather than an Important one because, wh
Debian
CVE-2025-5702: glibc - The strcmp implementation optimized for the Power10 processor in the GNU C Libra...
vendor_debian·2025·CVSS 5.6
CVE-2025-5702 [MEDIUM] CVE-2025-5702: glibc - The strcmp implementation optimized for the Power10 processor in the GNU C Libra...
The strcmp implementation optimized for the Power10 processor in the GNU C Library version 2.39 and later writes to vector registers v20 to v31 without saving contents from the caller (those registers are defined as non-volatile registers by the powerpc64le ABI), resulting in overwriting of its contents and potentially altering control flow of the caller, or leaking the input strings to the function to other parts of the program.
Scope: local
bookworm: resolved
bullseye: resolved
forky: resolved (fixed in 2.41-9)
sid: resolved (fixed in 2.41-9)
trixie: resolved (fixed in 2.41-9)
Microsoft
Memory corruption in the networking stack could have led to a potentially exploitable crash. This vulnerability affects Firefox < 125, Firefox ESR < 115.12, and Thunderbird < 115.12.
vendor_msrc·2024-06-11·CVSS 7.5
CVE-2024-5702 [HIGH] CWE-416 Memory corruption in the networking stack could have led to a potentially exploitable crash. This vulnerability affects Firefox < 125, Firefox ESR < 115.12, and Thunderbird < 115.12.
Memory corruption in the networking stack could have led to a potentially exploitable crash. This vulnerability affects Firefox Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
mozilla: mozilla
Customer Action Requ
OSV
glibc vulnerabilities
osv·2025-07-14·CVSS 5.6
CVE-2025-5702 [MEDIUM] glibc vulnerabilities
glibc vulnerabilities
It was discovered that the GNU C Library incorrectly handled the strcmp
implementation optimized for Power10 processors. This could cause
applications to crash, compute wrong results, or leak confidential
information. (CVE-2025-5702)
It was discovered that the GNU C Library incorrectly handled the strncmp
implementation optimized for Power10 processors. This could cause
applications to crash, compute wrong results, or leak confidential
information. This issue only affected Ubuntu 25.04. (CVE-2025-5745)
OSV
CVE-2025-5702: The strcmp implementation optimized for the Power10 processor in the GNU C Library version 2
osv·2025-06-05·CVSS 5.6
CVE-2025-5702 [MEDIUM] CVE-2025-5702: The strcmp implementation optimized for the Power10 processor in the GNU C Library version 2
The strcmp implementation optimized for the Power10 processor in the GNU C Library version 2.39 and later writes to vector registers v20 to v31 without saving contents from the caller (those registers are defined as non-volatile registers by the powerpc64le ABI), resulting in overwriting of its contents and potentially altering control flow of the caller, or leaking the input strings to the function to other parts of the program.
GHSA
GHSA-hqwp-qwfv-mhrx: The strcmp implementation optimized for the Power10 processor in the GNU C Library version 2
ghsa_unreviewed·2025-06-05
CVE-2025-5702 [MEDIUM] CWE-665 GHSA-hqwp-qwfv-mhrx: The strcmp implementation optimized for the Power10 processor in the GNU C Library version 2
The strcmp implementation optimized for the Power10 processor in the GNU C Library version 2.39 and later writes to vector registers v20 to v31 without saving contents from the caller (those registers are defined as non-volatile registers by the powerpc64le ABI), resulting in overwriting of its contents and potentially altering control flow of the caller, or leaking the input strings to the function to other parts of the program.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-06-05
Published