CVE-2026-97399
published 2026-09-28CVE-2026-97399: The strncasecmp function in the GNU C Library 2.24 and later optimized for the Power8 architecture may read one byte beyond the input size limit, which may…
PriorityP415low3.7CVSS 3.1
AVNACHPRNUINSUCNINAL
EPSS
0.29%
20.6th percentile
The strncasecmp function in the GNU C Library 2.24 and later optimized for the Power8 architecture may read one byte beyond the input size limit, which may crash a program when that byte is not readable.
This condition may happen when the input strings to the strncasecmp function are attacker controlled in an application and they match all the way up to the edge of their page and the neighbouring page is either not mapped or is not readable.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| gnu | glibc | — | — |
| openshift | ose-rhel-coreos-8 | — | — |
| openshift | ose-rhel-coreos-9 | — | — |
| the_gnu_c_library | glibc | >= 2.24 < 2.45 | 2.45 |
CVSS provenance
nvdv3.13.7LOWCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
vendor_redhat3.7LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
glibc: glibc: Denial of Service via out-of-bounds read in strncasecmp
vendor_redhat·2026-09-28·CVSS 3.7
CVE-2026-97399 [LOW] CWE-125 glibc: glibc: Denial of Service via out-of-bounds read in strncasecmp
glibc: glibc: Denial of Service via out-of-bounds read in strncasecmp
The strncasecmp function in the GNU C Library 2.24 and later optimized for the Power8 architecture may read one byte beyond the input size limit, which may crash a program when that byte is not readable.
This condition may happen when the input strings to the strncasecmp function are attacker controlled in an application and they match all the way up to the edge of their page and the neighbouring page is either not mapped or is not readable.
A flaw was found in glibc. In builds optimized for specific hardware architectures, the string comparison function strncasecmp may read one byte beyond the boundary of the provided input string. An attacker capable of passing controlled strings that end at the edge of a memory page
GHSA
The strncasecmp function in the GNU C Library 2.24 and later optimized for the Power8 architecture may read one byte beyond the input size limit, which may crash a program when that byte is not readab
ghsa_unreviewed·2026-09-28
CVE-2026-97399 [LOW] CWE-126 The strncasecmp function in the GNU C Library 2.24 and later optimized for the Power8 architecture may read one byte beyond the input size limit, which may crash a program when that byte is not readab
The strncasecmp function in the GNU C Library 2.24 and later optimized for the Power8 architecture may read one byte beyond the input size limit, which may crash a program when that byte is not readable.
This condition may happen when the input strings to the strncasecmp function are attacker controlled in an application and they match all the way up to the edge of their page and the neighbouring page is either not mapped or is not readable.
No detection rules found.
No public exploits indexed.
2026-09-28
Published