Bug 2542525 (CVE-2026-97399) - CVE-2026-97399 glibc: glibc: Denial of Service via out-of-bounds read in strncasecmp
Summary: CVE-2026-97399 glibc: glibc: Denial of Service via out-of-bounds read in strn...
Keywords:
Status: NEW
Alias: CVE-2026-97399
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-09-28 15:32 UTC by OSIDB Bzimport
Modified: 2026-09-28 15:38 UTC (History)
22 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-09-28 15:32:11 UTC 
The strncasecmp function in the GNU C Library 2.24 and later optimized for the Power8 architecture may read one byte beyond the input size limit, which may crash a program when that byte is not readable.

This condition may happen when the input strings to the strncasecmp function are attacker controlled in an application and they match all the way up to the edge of their page and the neighbouring page is either not mapped or is not readable.
Note You need to log in before you can comment on or make changes to this bug.