Low severity · published Sep 28, 2026
CVE-2026-97399
One-byte overread in strncasecmp on Power8
3.7
CVSS
0.3%
EPSS
No
On KEV
Description
The strncasecmp function in the GNU C Library 2.24 and later optimized for the Power8 architecture may read one byte beyond the input size limit, which may crash a program when that byte is not readable.
This condition may happen when the input strings to the strncasecmp function are attacker controlled in an application and they match all the way up to the edge of their page and the neighbouring page is either not mapped or is not readable.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 20% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GL
glibc · The GNU C Library
2.24 before 2.45 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-97399
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-97399
issue-tracking
https://sourceware.org/bugzilla/show_bug.cgi?id=34683
vendor-advisory
https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0024
More from glibc
9.8
CVE-2026-5450
scanf %mc off-by-one heap buffer overflow
8.4
CVE-2026-0861
Integer overflow in memalign leads to heap corruption
8.1
CVE-2024-33599
nscd: Stack-based buffer overflow in netgroup cache
7.7
CVE-2026-19499
Buffer overflow in strfmon and strfmon_l right-justification padding
7.5
CVE-2026-5928
Potential buffer under-read in ungetwc