Skip to content
Heist/ feed
Low

One-byte overread in strncasecmp on Power8

Type: advisorySource: Official CVE List1 source record

The strncasecmp function in the GNU C Library 2.24 and later optimized for the Power8 architecture may read one byte beyond the input size limit, which may crash a program when that byte is not readable. This condition may happen when the input strings to the strncasecmp function are attacker controlled in an application and they match all the way up to the edge of their page and the neighbouring page is either not mapped or is not readable.

Announced Source revision 1
Original source ↗

CVE-2026-97399

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-97399

glibc

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "vendor": "The GNU C Library",
    "product": "glibc",
    "versions": [
      {
        "status": "affected",
        "version": "2.24",
        "lessThan": "2.45",
        "versionType": "custom"
      }
    ],
    "platforms": [
      "Power8"
    ],
    "defaultStatus": "unaffected"
  }
]
Related CVEs
CVE-2026-97399

Source reference: /cveMetadata/cveId

Publisher severity

low

Source reference: /containers/cna/metrics

Event
#3240 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement