CVE-2026-97399: low-severity vulnerability in The GNU C Library glibc
One-byte overread in strncasecmp on Power8
Published
8Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 3.7epss 0.3%
exploitation probability
0.3%top 80% of all CVEs
observed exploitation
nono source reports it
The strncasecmp function in the GNU C Library 2.24 and later optimized for the Power8 architecture may read one byte beyond the input size limit, which may crash a program when that byte is not readable.
This condition may happen when the input strings to the strncasecmp function are attacker controlled in an application and they match all the way up to the edge of their page and the neighbouring page is either not mapped or is not readable.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Affected products
The GNU C Library · glibcRelated CVEs — The GNU C Library glibc
In the same product, most dangerous first.
CVE-2024-2961HIGHCVE-2024-2961EPSS 88.3%CVE-2024-33599HIGHnscd: Stack-based buffer overflow in netgroup cacheEPSS 1.3%CVE-2024-33600MEDIUMnscd: Null pointer crashes after notfound responseEPSS 1.2%CVE-2024-33601HIGHnscd: netgroup cache may terminate daemon on memory allocation failureEPSS 1.1%CVE-2026-5450CRITICALscanf %mc off-by-one heap buffer overflowEPSS 0.7%CVE-2026-4046HIGHiconv crash due to assertion failure with untrusted inputEPSS 0.7%