{"id":"CVE-2026-97399","aliases":["AZL-104976","DEBIAN-CVE-2026-97399","EUVD-2026-88320","GHSA-qhjw-2xw3-v2hv","SUSE-SU-2026:24281-1","SUSE-SU-2026:24326-1","SUSE-SU-2026:4591-1","SUSE-SU-2026:4656-1","UBUNTU-CVE-2026-97399","openSUSE-SU-2026:12072-1"],"status":"published","title":"One-byte overread in strncasecmp on Power8","description":"The strncasecmp function in the GNU C Library 2.24 and later optimized for the Power8 architecture may read one byte beyond the input size limit, which may crash a program when that byte is not readable.\n\nThis condition may happen when the input strings to the strncasecmp function are attacker controlled in an application and they match all the way up to the edge of their page and the neighbouring page is either not mapped or is not readable.","severity":{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00281,"percentile":0.20737,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-126"],"published":"2026-09-28T15:21:02Z","modified":"2026-10-27T17:23:14Z","fixes":[{"ecosystem":"Debian:14","package":"glibc","fixed_in":["2.43-7"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.38-21"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.36-10~0","2.36-9","2.36-9+deb12u1","2.36-9+deb12u10","2.36-9+deb12u11","2.36-9+deb12u12","2.36-9+deb12u13","2.36-9+deb12u14","2.36-9+deb12u2","2.36-9+deb12u3","2.36-9+deb12u4","2.36-9+deb12u5","2.36-9+deb12u6","2.36-9+deb12u7","2.36-9+deb12u8","2.36-9+deb12u9","2.36-9+loong64","2.37-1","2.37-10","2.37-11","2.37-12","2.37-13","2.37-14","2.37-15","2.37-15.1","2.37-15.1+sh4","2.37-15~deb13u1","2.37-16","2.37-17","2.37-18","2.37-19","2.37-2","2.37-3","2.37-4","2.37-5","2.37-6","2.37-7","2.37-8","2.37-9","2.38-1","2.38-10","2.38-11","2.38-12","2.38-12.1","2.38-13","2.38-14","2.38-15~0","2.38-15~1","2.38-2","2.38-3","2.38-4","2.38-5","2.38-6","2.38-7","2.38-7~0+hurd.1","2.38-8","2.38-9","2.39-1","2.39-2","2.39-3","2.39-3.1","2.39-4","2.39-5","2.39-6","2.39-6+hurd.1","2.39-6+sh4","2.39-7","2.39-7+sh4","2.39-7~0","2.39-8~0","2.40-1","2.40-2","2.40-2+sh4","2.40-3","2.40-3+sh4","2.40-4","2.40-5","2.40-5~hurd.1","2.40-6","2.40-6~1","2.40-7","2.41-1","2.41-10","2.41-11","2.41-12","2.41-13~hurd.0","2.41-13~hurd.1","2.41-2","2.41-3","2.41-4","2.41-4~0","2.41-5","2.41-5~0","2.41-6","2.41-7","2.41-8","2.41-8~0","2.41-8~1","2.41-9","2.41-9~0","2.41-9~1","2.42-1","2.42-10","2.42-11","2.42-12","2.42-12~hurd.1","2.42-13","2.42-14","2.42-14~hurd.1","2.42-15","2.42-15~hurd.1","2.42-16","2.42-17","2.42-2","2.42-3","2.42-4","2.42-5","2.42-6","2.42-7","2.42-8","2.42-8~hurd.1","2.42-8~hurd.2","2.42-9","2.43-1","2.43-2","2.43-3","2.43-3+m68k","2.43-4","2.43-4+m68k","2.43-5","2.43-6","2.43-7","2.43-7~hurd.1","2.44-1","2.44-2","2.44-3"]},{"source":"osv","ecosystem":"Debian:13","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.41-12","2.41-12+deb13u1","2.41-12+deb13u2","2.41-12+deb13u3","2.41-12+deb13u4","2.41-13~hurd.0","2.41-13~hurd.1","2.42-1","2.42-10","2.42-11","2.42-12","2.42-12~hurd.1","2.42-13","2.42-14","2.42-14~hurd.1","2.42-15","2.42-15~hurd.1","2.42-16","2.42-17","2.42-2","2.42-3","2.42-4","2.42-5","2.42-6","2.42-7","2.42-8","2.42-8~hurd.1","2.42-8~hurd.2","2.42-9","2.43-1","2.43-2","2.43-3","2.43-3+m68k","2.43-4","2.43-4+m68k","2.43-5","2.43-6","2.43-7","2.43-7~hurd.1","2.44-1","2.44-2","2.44-3"]},{"source":"osv","ecosystem":"Debian:14","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.43-7"}]}],"versions":["2.41-12","2.41-13~hurd.0","2.41-13~hurd.1","2.42-1","2.42-10","2.42-11","2.42-12","2.42-12~hurd.1","2.42-13","2.42-14","2.42-14~hurd.1","2.42-15","2.42-15~hurd.1","2.42-16","2.42-17","2.42-2","2.42-3","2.42-4","2.42-5","2.42-6","2.42-7","2.42-8","2.42-8~hurd.1","2.42-8~hurd.2","2.42-9","2.43-1","2.43-2","2.43-3","2.43-3+m68k","2.43-4","2.43-4+m68k","2.43-5","2.43-6","2.43-7~hurd.1"]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.38-slfo.1.1_11.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.38-159998.1.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.31-150300.109.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.31-150300.109.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.31-150300.109.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.31-150300.109.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.31-150300.109.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.31-150300.109.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.31-150300.109.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.31-150300.109.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.31-150300.109.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.31-150300.109.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.31-150300.109.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.38-150600.14.61.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.38-150600.14.61.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.38-150600.14.61.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.38-150600.14.61.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"eglibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.17-93ubuntu4","2.18-0ubuntu1","2.18-0ubuntu2","2.18-0ubuntu4","2.18-0ubuntu5","2.18-0ubuntu6","2.18-0ubuntu7","2.19-0ubuntu2","2.19-0ubuntu3","2.19-0ubuntu4","2.19-0ubuntu5","2.19-0ubuntu6","2.19-0ubuntu6.1","2.19-0ubuntu6.3","2.19-0ubuntu6.4","2.19-0ubuntu6.5","2.19-0ubuntu6.6","2.19-0ubuntu6.7","2.19-0ubuntu6.8","2.19-0ubuntu6.9","2.19-0ubuntu6.10","2.19-0ubuntu6.11","2.19-0ubuntu6.13","2.19-0ubuntu6.14","2.19-0ubuntu6.15","2.19-0ubuntu6.15+esm1","2.19-0ubuntu6.15+esm2","2.19-0ubuntu6.15+esm3","2.19-0ubuntu6.15+esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.21-0ubuntu4","2.21-0ubuntu5","2.21-0ubuntu6","2.23-0ubuntu1","2.23-0ubuntu2","2.23-0ubuntu3","2.23-0ubuntu4","2.23-0ubuntu5","2.23-0ubuntu6","2.23-0ubuntu7","2.23-0ubuntu9","2.23-0ubuntu10","2.23-0ubuntu11","2.23-0ubuntu11.2","2.23-0ubuntu11.3","2.23-0ubuntu11.3+esm1","2.23-0ubuntu11.3+esm2","2.23-0ubuntu11.3+esm3","2.23-0ubuntu11.3+esm5","2.23-0ubuntu11.3+esm6","2.23-0ubuntu11.3+esm7","2.23-0ubuntu11.3+esm8","2.23-0ubuntu11.3+esm9"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.26-0ubuntu2","2.26-0ubuntu2.1","2.27-0ubuntu2","2.27-0ubuntu3","2.27-3ubuntu1","2.27-3ubuntu1.2","2.27-3ubuntu1.3","2.27-3ubuntu1.4","2.27-3ubuntu1.5","2.27-3ubuntu1.6","2.27-3ubuntu1.6+esm1","2.27-3ubuntu1.6+esm2","2.27-3ubuntu1.6+esm3","2.27-3ubuntu1.6+esm4","2.27-3ubuntu1.6+esm5","2.27-3ubuntu1.6+esm6"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.30-0ubuntu2","2.30-0ubuntu3","2.31-0ubuntu5","2.31-0ubuntu6","2.31-0ubuntu7","2.31-0ubuntu9","2.31-0ubuntu9.1","2.31-0ubuntu9.2","2.31-0ubuntu9.3","2.31-0ubuntu9.7","2.31-0ubuntu9.9","2.31-0ubuntu9.12","2.31-0ubuntu9.14","2.31-0ubuntu9.15","2.31-0ubuntu9.16","2.31-0ubuntu9.17","2.31-0ubuntu9.18","2.31-0ubuntu9.18+esm1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.34-0ubuntu3","2.35-0ubuntu1","2.35-0ubuntu3","2.35-0ubuntu3.1","2.35-0ubuntu3.3","2.35-0ubuntu3.4","2.35-0ubuntu3.5","2.35-0ubuntu3.6","2.35-0ubuntu3.7","2.35-0ubuntu3.8","2.35-0ubuntu3.9","2.35-0ubuntu3.10","2.35-0ubuntu3.11","2.35-0ubuntu3.12","2.35-0ubuntu3.13","2.35-0ubuntu3.14","2.35-0ubuntu3.15"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.38-1ubuntu6","2.38-3ubuntu1","2.39-0ubuntu1","2.39-0ubuntu2","2.39-0ubuntu6","2.39-0ubuntu8","2.39-0ubuntu8.1","2.39-0ubuntu8.2","2.39-0ubuntu8.3","2.39-0ubuntu8.4","2.39-0ubuntu8.5","2.39-0ubuntu8.6","2.39-0ubuntu8.7","2.39-0ubuntu8.8","2.39-0ubuntu8.9"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.42-0ubuntu3","2.42-2ubuntu1","2.42-2ubuntu2","2.42-2ubuntu4","2.42-2ubuntu5","2.43-2ubuntu1","2.43-2ubuntu2","2.43-2ubuntu2.3","2.43-2ubuntu2.4"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.44-3.1"}]}],"bundled":3}],"products":[{"vendor":"the gnu c library","product":"glibc"}],"references":[{"url":"https://sourceware.org/bugzilla/show_bug.cgi?id=34683","tags":["issue-tracking"]},{"url":"https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0024","tags":["vendor-advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/09/28/7","tags":["report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97399","tags":["web"]},{"url":"https://github.com/advisories/GHSA-qhjw-2xw3-v2hv"},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-97399","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624281-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1281297","tags":["report"]},{"url":"https://bugzilla.suse.com/1282449","tags":["report"]},{"url":"https://bugzilla.suse.com/1282509","tags":["report"]},{"url":"https://bugzilla.suse.com/1283147","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-8674","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-86805","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89092","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97399","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624326-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264591-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1274723","tags":["report"]},{"url":"https://bugzilla.suse.com/1274726","tags":["report"]},{"url":"https://bugzilla.suse.com/1276946","tags":["report"]},{"url":"https://bugzilla.suse.com/1277262","tags":["report"]},{"url":"https://bugzilla.suse.com/1277921","tags":["report"]},{"url":"https://bugzilla.suse.com/1277922","tags":["report"]},{"url":"https://bugzilla.suse.com/1278011","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-18374","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-19542","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6368","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6791","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-77117","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80489","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264656-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-97399","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-97399","tags":["report"]},{"url":"https://sourceware.org/git/?p=glibc.git;a=blob;f=advisories/GLIBC-SA-2026-0024","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-97399","title":"One-byte overread in strncasecmp on Power8","description":"The strncasecmp function in the GNU C Library 2.24 and later optimized for the Power8 architecture may read one byte beyond the input size limit, which may crash a program when that byte is not readable.\n\nThis condition may happen when the input strings to the strncasecmp function are attacker controlled in an application and they match all the way up to the edge of their page and the neighbouring page is either not mapped or is not readable.","status":"published","published":"2026-09-28T15:21:02.09Z","modified":"2026-09-28T17:07:36.744Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low","assessor":"cna"}],"cwes":["CWE-126"],"updated_at":"2026-11-02T13:44:18.366073Z"}],"euvd":[{"id":"EUVD-2026-88320","description":"The strncasecmp function in the GNU C Library 2.24 and later optimized for the Power8 architecture may read one byte beyond the input size limit, which may crash a program when that byte is not readable.\n\nThis condition may happen when the input strings to the strncasecmp function are attacker controlled in an application and they match all the way up to the edge of their page and the neighbouring page is either not mapped or is not readable.","status":"published","published":"2026-09-28T15:21:02Z","modified":"2026-09-28T17:07:36Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-02T17:27:53.091489Z"}],"ghsa":[{"id":"GHSA-qhjw-2xw3-v2hv","title":"The strncasecmp function in the GNU C Library 2.24 and later optimized for the Power8...","description":"The strncasecmp function in the GNU C Library 2.24 and later optimized for the Power8 architecture may read one byte beyond the input size limit, which may crash a program when that byte is not readable.\n\nThis condition may happen when the input strings to the strncasecmp function are attacker controlled in an application and they match all the way up to the edge of their page and the neighbouring page is either not mapped or is not readable.","status":"published","published":"2026-09-28T18:31:24Z","modified":"2026-09-28T18:31:33Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"cwes":["CWE-126"],"updated_at":"2026-11-02T15:12:32.639211Z"}],"nvd":[{"id":"CVE-2026-97399","description":"The strncasecmp function in the GNU C Library 2.24 and later optimized for the Power8 architecture may read one byte beyond the input size limit, which may crash a program when that byte is not readable.\n\nThis condition may happen when the input strings to the strncasecmp function are attacker controlled in an application and they match all the way up to the edge of their page and the neighbouring page is either not mapped or is not readable.","status":"published","published":"2026-09-28T16:17:18.55Z","modified":"2026-09-29T21:36:39.547Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low","assessor":"secondary"}],"cwes":["CWE-126"],"updated_at":"2026-11-02T14:12:52.081323Z"}],"osv":[{"id":"DEBIAN-CVE-2026-97399","description":"The strncasecmp function in the GNU C Library 2.24 and later optimized for the Power8 architecture may read one byte beyond the input size limit, which may crash a program when that byte is not readable.  This condition may happen when the input strings to the strncasecmp function are attacker controlled in an application and they match all the way up to the edge of their page and the neighbouring page is either not mapped or is not readable.","status":"published","published":"2026-09-28T16:17:18.55Z","modified":"2026-10-11T05:00:07.661173676Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-02T15:46:07.324252Z"},{"id":"UBUNTU-CVE-2026-97399","description":"The strncasecmp function in the GNU C Library 2.24 and later optimized for the Power8 architecture may read one byte beyond the input size limit, which may crash a program when that byte is not readable. This condition may happen when the input strings to the strncasecmp function are attacker controlled in an application and they match all the way up to the edge of their page and the neighbouring page is either not mapped or is not readable.","status":"published","published":"2026-09-28T16:17:00Z","modified":"2026-10-01T19:11:28.548573898Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-02T16:57:48.647391Z"},{"id":"AZL-104976","title":"CVE-2026-97399 affecting package glibc 2.38-21","description":"The strncasecmp function in the GNU C Library 2.24 and later optimized for the Power8 architecture may read one byte beyond the input size limit, which may crash a program when that byte is not readable.\n\nThis condition may happen when the input strings to the strncasecmp function are attacker controlled in an application and they match all the way up to the edge of their page and the neighbouring page is either not mapped or is not readable.","status":"published","published":"2026-09-28T16:17:18Z","modified":"2026-10-15T05:37:09Z","updated_at":"2026-11-02T15:28:01.09948Z"},{"id":"openSUSE-SU-2026:12072-1","title":"glibc-2.44-3.1 on GA media","description":"These are all security issues fixed in the glibc-2.44-3.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-07T00:00:00Z","modified":"2026-10-09T17:23:12.618616689Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"SUSE-SU-2026:24281-1","title":"Security update for glibc","description":"This update for glibc fixes the following issues:\n\n- CVE-2026-8674: reachable assert in `resolv/resolv_conf.c:update_from_conf` allows an attacker in a local network to\n  trigger a process crash (bsc#1281297).\n- CVE-2026-86805: TOCTOU race condition in the dynamic loader allows local attackers to escalate privileges\n  (bsc#1282509).\n- CVE-2026-89092: nscd stack overflow leads to degraded DNS resolution (bsc#1282449).\n- CVE-2026-97399: one byte out-of-bounds read via function `strncasecmp` on Power8 can lead to a program crash\n  (bsc#1283147).\n","status":"published","published":"2026-10-19T10:26:04Z","modified":"2026-10-27T17:23:10.508907557Z","updated_at":"2026-11-02T15:54:04.519245Z"},{"id":"SUSE-SU-2026:24326-1","title":"Security update for glibc","description":"This update for glibc fixes the following issues:\n\n- CVE-2026-8674: reachable assert in `resolv/resolv_conf.c:update_from_conf` allows an attacker in a local network to\n  trigger a process crash (bsc#1281297).\n- CVE-2026-86805: TOCTOU race condition in the dynamic loader allows local attackers to escalate privileges\n  (bsc#1282509).\n- CVE-2026-89092: nscd stack overflow leads to degraded DNS resolution (bsc#1282449).\n- CVE-2026-97399: one byte out-of-bounds read via function `strncasecmp` on Power8 can lead to a program crash\n  (bsc#1283147).\n","status":"published","published":"2026-10-19T08:37:31Z","modified":"2026-10-27T17:23:14.122169891Z","updated_at":"2026-11-02T15:54:04.519245Z"},{"id":"SUSE-SU-2026:4591-1","title":"Security update for glibc","description":"This update for glibc fixes the following issues:\n\n- CVE-2026-6368: wordexp WRDE_APPEND rollback restores stale we_wordv, leading to invalid free in wordfree\n  (bsc#1274726).\n- CVE-2026-6791: wordexp: unbounded alloca (strndupa) in parse_tilde (bsc#1274723).\n- CVE-2026-8674: reachable assert in `resolv/resolv_conf.c:update_from_conf` allows an attacker in a local network to\n  trigger a process crash (bsc#1281297).\n- CVE-2026-18374: overflow in the fopen ccs extension (bsc#1277262).\n- CVE-2026-19542: Fix out-of-bounds array write in tdelete (bsc#1276946).\n- CVE-2026-77117: non-progress DoS in SHIFT_JISX0213 -\u0026gt; UCS-4 conversion state handling (bsc#1277921).\n- CVE-2026-80489: non-progress DoS in SHIFT_JISX0213 -\u0026gt; UCS-4 conversion state handling (bsc#1277922).\n- CVE-2026-86805: TOCTOU race condition in the dynamic loader allows local attackers to escalate privileges\n  (bsc#1282509).\n- CVE-2026-89092: nscd stack overflow leads to degraded DNS resolution (bsc#1282449).\n- CVE-2026-97399: one byte out-of-bounds read via function `strncasecmp` on Power8 can lead to a program crash\n  (bsc#1283147).\n","status":"published","published":"2026-10-08T12:18:31Z","modified":"2026-10-09T18:15:03.742602908Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"SUSE-SU-2026:4656-1","title":"Security update for glibc","description":"This update for glibc fixes the following issues:\n\n- CVE-2026-8674: reachable assert in `resolv/resolv_conf.c:update_from_conf` allows an attacker in a local network to\n  trigger a process crash (bsc#1281297).\n- CVE-2026-86805: TOCTOU race condition in the dynamic loader allows local attackers to escalate privileges\n  (bsc#1282509).\n- CVE-2026-89092: nscd stack overflow leads to degraded DNS resolution (bsc#1282449).\n- CVE-2026-97399: one byte out-of-bounds read via function `strncasecmp` on Power8 can lead to a program crash\n  (bsc#1283147).\n","status":"published","published":"2026-10-14T07:48:58Z","modified":"2026-10-14T17:30:08.71945699Z","updated_at":"2026-11-02T15:54:05.838224Z"}]}}