Vulnerability-Lookup

SUSE-SU-2026:24326-1

Vulnerability from csaf_suse - Published: 2026-10-19 08:37 - Updated: 2026-10-26 19:20

Summary

Security update for glibc

Severity

Important

Notes

Title of the patch: Security update for glibc

Description of the patch: This update for glibc fixes the following issues: - CVE-2026-8674: reachable assert in `resolv/resolv_conf.c:update_from_conf` allows an attacker in a local network to trigger a process crash (bsc#1281297). - CVE-2026-86805: TOCTOU race condition in the dynamic loader allows local attackers to escalate privileges (bsc#1282509). - CVE-2026-89092: nscd stack overflow leads to degraded DNS resolution (bsc#1282449). - CVE-2026-97399: one byte out-of-bounds read via function `strncasecmp` on Power8 can lead to a program crash (bsc#1283147).

Patchnames: SUSE-SLE-Micro-6.0-936

CVE-2026-8674

5.3 (Medium)


                
                  CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 12 products

Product	Version	Remediation
Unresolved product id: SUSE Linux Micro 6.0:glibc-0:2.38-159998.1.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.0:glibc-0:2.38-159998.1.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.0:glibc-0:2.38-159998.1.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.0:glibc-devel-0:2.38-159998.1.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.0:glibc-devel-0:2.38-159998.1.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.0:glibc-devel-0:2.38-159998.1.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.0:glibc-locale-0:2.38-159998.1.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.0:glibc-locale-0:2.38-159998.1.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.0:glibc-locale-0:2.38-159998.1.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.0:glibc-locale-base-0:2.38-159998.1.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.0:glibc-locale-base-0:2.38-159998.1.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.0:glibc-locale-base-0:2.38-159998.1.1.x86_64	—	Vendor Fix

Threats

Impact moderate

CVE-2026-86805

7 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 12 products, the same list as for CVE-2026-8674

Threats

Impact important

CVE-2026-89092

5.3 (Medium)


                
                  CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 12 products, the same list as for CVE-2026-8674

Threats

Impact moderate

CVE-2026-97399

5.9 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 12 products, the same list as for CVE-2026-8674

Threats

Impact moderate

References

21 references

URL	Category
https://www.suse.com/support/security/rating/	external
https://ftp.suse.com/pub/projects/security/csaf/s…	self
https://www.suse.com/support/update/announcement/…	self
https://www.suse.com/support/update/announcement/…	self
https://bugzilla.suse.com/1281297	self
https://bugzilla.suse.com/1282449	self
https://bugzilla.suse.com/1282509	self
https://bugzilla.suse.com/1283147	self
https://www.suse.com/security/cve/CVE-2026-8674/	self
https://www.suse.com/security/cve/CVE-2026-86805/	self
https://www.suse.com/security/cve/CVE-2026-89092/	self
https://www.suse.com/security/cve/CVE-2026-97399/	self
https://www.suse.com/security/cve/CVE-2026-8674	external
https://bugzilla.suse.com/1281297	external
https://www.suse.com/security/cve/CVE-2026-86805	external
https://bugzilla.suse.com/1282509	external
https://bugzilla.suse.com/1282587	external
https://www.suse.com/security/cve/CVE-2026-89092	external
https://bugzilla.suse.com/1282449	external
https://www.suse.com/security/cve/CVE-2026-97399	external
https://bugzilla.suse.com/1283147	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for glibc",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for glibc fixes the following issues:\n\n- CVE-2026-8674: reachable assert in `resolv/resolv_conf.c:update_from_conf` allows an attacker in a local network to\n  trigger a process crash (bsc#1281297).\n- CVE-2026-86805: TOCTOU race condition in the dynamic loader allows local attackers to escalate privileges\n  (bsc#1282509).\n- CVE-2026-89092: nscd stack overflow leads to degraded DNS resolution (bsc#1282449).\n- CVE-2026-97399: one byte out-of-bounds read via function `strncasecmp` on Power8 can lead to a program crash\n  (bsc#1283147).\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-SLE-Micro-6.0-936",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_24326-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2026:24326-1",
        "url": "https://www.suse.com/support/update/announcement/2026/suse-su-202624326-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2026:24326-1",
        "url": "https://www.suse.com/support/update/announcement/2026/suse-su-202624326-1/"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1281297",
        "url": "https://bugzilla.suse.com/1281297"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1282449",
        "url": "https://bugzilla.suse.com/1282449"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1282509",
        "url": "https://bugzilla.suse.com/1282509"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1283147",
        "url": "https://bugzilla.suse.com/1283147"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-8674 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-8674/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-86805 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-86805/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-89092 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-89092/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-97399 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-97399/"
      }
    ],
    "title": "Security update for glibc",
    "tracking": {
      "current_release_date": "2026-10-26T19:20:15Z",
      "generator": {
        "date": "2026-10-19T08:37:31Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2026:24326-1",
      "initial_release_date": "2026-10-19T08:37:31Z",
      "revision_history": [
        {
          "date": "2026-10-19T08:37:31Z",
          "number": "1",
          "summary": "Current version"
        },
        {
          "date": "2026-10-26T19:20:15Z",
          "number": "2",
          "summary": "unknown changes"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "glibc-0:2.38-159998.1.1.aarch64",
                "product": {
                  "name": "glibc-0:2.38-159998.1.1.aarch64",
                  "product_id": "glibc-0:2.38-159998.1.1.aarch64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:gnu:glibc:2.38:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/glibc@2.38-159998.1.1?arch=aarch64\u0026upstream=glibc-0:2.38-159998.1.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "glibc-devel-0:2.38-159998.1.1.aarch64",
                "product": {
                  "name": "glibc-devel-0:2.38-159998.1.1.aarch64",
                  "product_id": "glibc-devel-0:2.38-159998.1.1.aarch64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:gnu:glibc:2.38:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/glibc-devel@2.38-159998.1.1?arch=aarch64\u0026upstream=glibc-0:2.38-159998.1.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "glibc-locale-0:2.38-159998.1.1.aarch64",
                "product": {
                  "name": "glibc-locale-0:2.38-159998.1.1.aarch64",
                  "product_id": "glibc-locale-0:2.38-159998.1.1.aarch64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:gnu:glibc:2.38:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/glibc-locale@2.38-159998.1.1?arch=aarch64\u0026upstream=glibc-0:2.38-159998.1.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "glibc-locale-base-0:2.38-159998.1.1.aarch64",
                "product": {
                  "name": "glibc-locale-base-0:2.38-159998.1.1.aarch64",
                  "product_id": "glibc-locale-base-0:2.38-159998.1.1.aarch64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:gnu:glibc:2.38:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/glibc-locale-base@2.38-159998.1.1?arch=aarch64\u0026upstream=glibc-0:2.38-159998.1.1.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "glibc-0:2.38-159998.1.1.s390x",
                "product": {
                  "name": "glibc-0:2.38-159998.1.1.s390x",
                  "product_id": "glibc-0:2.38-159998.1.1.s390x",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:gnu:glibc:2.38:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/glibc@2.38-159998.1.1?arch=s390x\u0026upstream=glibc-0:2.38-159998.1.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "glibc-devel-0:2.38-159998.1.1.s390x",
                "product": {
                  "name": "glibc-devel-0:2.38-159998.1.1.s390x",
                  "product_id": "glibc-devel-0:2.38-159998.1.1.s390x",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:gnu:glibc:2.38:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/glibc-devel@2.38-159998.1.1?arch=s390x\u0026upstream=glibc-0:2.38-159998.1.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "glibc-locale-0:2.38-159998.1.1.s390x",
                "product": {
                  "name": "glibc-locale-0:2.38-159998.1.1.s390x",
                  "product_id": "glibc-locale-0:2.38-159998.1.1.s390x",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:gnu:glibc:2.38:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/glibc-locale@2.38-159998.1.1?arch=s390x\u0026upstream=glibc-0:2.38-159998.1.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "glibc-locale-base-0:2.38-159998.1.1.s390x",
                "product": {
                  "name": "glibc-locale-base-0:2.38-159998.1.1.s390x",
                  "product_id": "glibc-locale-base-0:2.38-159998.1.1.s390x",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:gnu:glibc:2.38:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/glibc-locale-base@2.38-159998.1.1?arch=s390x\u0026upstream=glibc-0:2.38-159998.1.1.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "glibc-0:2.38-159998.1.1.x86_64",
                "product": {
                  "name": "glibc-0:2.38-159998.1.1.x86_64",
                  "product_id": "glibc-0:2.38-159998.1.1.x86_64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:gnu:glibc:2.38:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/glibc@2.38-159998.1.1?arch=x86_64\u0026upstream=glibc-0:2.38-159998.1.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "glibc-devel-0:2.38-159998.1.1.x86_64",
                "product": {
                  "name": "glibc-devel-0:2.38-159998.1.1.x86_64",
                  "product_id": "glibc-devel-0:2.38-159998.1.1.x86_64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:gnu:glibc:2.38:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/glibc-devel@2.38-159998.1.1?arch=x86_64\u0026upstream=glibc-0:2.38-159998.1.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "glibc-locale-0:2.38-159998.1.1.x86_64",
                "product": {
                  "name": "glibc-locale-0:2.38-159998.1.1.x86_64",
                  "product_id": "glibc-locale-0:2.38-159998.1.1.x86_64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:gnu:glibc:2.38:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/glibc-locale@2.38-159998.1.1?arch=x86_64\u0026upstream=glibc-0:2.38-159998.1.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "glibc-locale-base-0:2.38-159998.1.1.x86_64",
                "product": {
                  "name": "glibc-locale-base-0:2.38-159998.1.1.x86_64",
                  "product_id": "glibc-locale-base-0:2.38-159998.1.1.x86_64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:gnu:glibc:2.38:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/glibc-locale-base@2.38-159998.1.1?arch=x86_64\u0026upstream=glibc-0:2.38-159998.1.1.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Micro 6.0",
                "product": {
                  "name": "SUSE Linux Micro 6.0",
                  "product_id": "SUSE Linux Micro 6.0",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sl-micro:6.0"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "glibc-0:2.38-159998.1.1.aarch64 as component of SUSE Linux Micro 6.0",
          "product_id": "SUSE Linux Micro 6.0:glibc-0:2.38-159998.1.1.aarch64"
        },
        "product_reference": "glibc-0:2.38-159998.1.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Micro 6.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "glibc-0:2.38-159998.1.1.s390x as component of SUSE Linux Micro 6.0",
          "product_id": "SUSE Linux Micro 6.0:glibc-0:2.38-159998.1.1.s390x"
        },
        "product_reference": "glibc-0:2.38-159998.1.1.s390x",
        "relates_to_product_reference": "SUSE Linux Micro 6.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "glibc-0:2.38-159998.1.1.x86_64 as component of SUSE Linux Micro 6.0",
          "product_id": "SUSE Linux Micro 6.0:glibc-0:2.38-159998.1.1.x86_64"
        },
        "product_reference": "glibc-0:2.38-159998.1.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Micro 6.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "glibc-devel-0:2.38-159998.1.1.aarch64 as component of SUSE Linux Micro 6.0",
          "product_id": "SUSE Linux Micro 6.0:glibc-devel-0:2.38-159998.1.1.aarch64"
        },
        "product_reference": "glibc-devel-0:2.38-159998.1.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Micro 6.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "glibc-devel-0:2.38-159998.1.1.s390x as component of SUSE Linux Micro 6.0",
          "product_id": "SUSE Linux Micro 6.0:glibc-devel-0:2.38-159998.1.1.s390x"
        },
        "product_reference": "glibc-devel-0:2.38-159998.1.1.s390x",
        "relates_to_product_reference": "SUSE Linux Micro 6.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "glibc-devel-0:2.38-159998.1.1.x86_64 as component of SUSE Linux Micro 6.0",
          "product_id": "SUSE Linux Micro 6.0:glibc-devel-0:2.38-159998.1.1.x86_64"
        },
        "product_reference": "glibc-devel-0:2.38-159998.1.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Micro 6.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "glibc-locale-0:2.38-159998.1.1.aarch64 as component of SUSE Linux Micro 6.0",
          "product_id": "SUSE Linux Micro 6.0:glibc-locale-0:2.38-159998.1.1.aarch64"
        },
        "product_reference": "glibc-locale-0:2.38-159998.1.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Micro 6.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "glibc-locale-0:2.38-159998.1.1.s390x as component of SUSE Linux Micro 6.0",
          "product_id": "SUSE Linux Micro 6.0:glibc-locale-0:2.38-159998.1.1.s390x"
        },
        "product_reference": "glibc-locale-0:2.38-159998.1.1.s390x",
        "relates_to_product_reference": "SUSE Linux Micro 6.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "glibc-locale-0:2.38-159998.1.1.x86_64 as component of SUSE Linux Micro 6.0",
          "product_id": "SUSE Linux Micro 6.0:glibc-locale-0:2.38-159998.1.1.x86_64"
        },
        "product_reference": "glibc-locale-0:2.38-159998.1.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Micro 6.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "glibc-locale-base-0:2.38-159998.1.1.aarch64 as component of SUSE Linux Micro 6.0",
          "product_id": "SUSE Linux Micro 6.0:glibc-locale-base-0:2.38-159998.1.1.aarch64"
        },
        "product_reference": "glibc-locale-base-0:2.38-159998.1.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Micro 6.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "glibc-locale-base-0:2.38-159998.1.1.s390x as component of SUSE Linux Micro 6.0",
          "product_id": "SUSE Linux Micro 6.0:glibc-locale-base-0:2.38-159998.1.1.s390x"
        },
        "product_reference": "glibc-locale-base-0:2.38-159998.1.1.s390x",
        "relates_to_product_reference": "SUSE Linux Micro 6.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "glibc-locale-base-0:2.38-159998.1.1.x86_64 as component of SUSE Linux Micro 6.0",
          "product_id": "SUSE Linux Micro 6.0:glibc-locale-base-0:2.38-159998.1.1.x86_64"
        },
        "product_reference": "glibc-locale-base-0:2.38-159998.1.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Micro 6.0"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-8674",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-8674"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Initializing the DNS stub resolver from an /etc/resolv.conf file, or a LOCALDOMAIN environment variable, whose search list contains a domain of roughly 200 characters or more in the GNU C Library version 2.26 to 2.44 results in an assertion failure which aborts the process.\n\nThe resolver truncates the search list when copying it into the fixed-size _res.defdname buffer, then asserts that the copy is consistent with the full configuration.  The consistency check compared against the wrong size and did not handle a first entry that does not fit, so a correctly truncated list failed the assertion.  Any process that resolves names through the library is affected, including long-running processes that reload /etc/resolv.conf on the next query after it changes.  Search domains are commonly written to /etc/resolv.conf from data received over DHCP or from a VPN server, so an attacker on the local network may be able to trigger this without privileges on the target system, subject to validation by the network configuration software.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.0:glibc-0:2.38-159998.1.1.aarch64",
          "SUSE Linux Micro 6.0:glibc-0:2.38-159998.1.1.s390x",
          "SUSE Linux Micro 6.0:glibc-0:2.38-159998.1.1.x86_64",
          "SUSE Linux Micro 6.0:glibc-devel-0:2.38-159998.1.1.aarch64",
          "SUSE Linux Micro 6.0:glibc-devel-0:2.38-159998.1.1.s390x",
          "SUSE Linux Micro 6.0:glibc-devel-0:2.38-159998.1.1.x86_64",
          "SUSE Linux Micro 6.0:glibc-locale-0:2.38-159998.1.1.aarch64",
          "SUSE Linux Micro 6.0:glibc-locale-0:2.38-159998.1.1.s390x",
          "SUSE Linux Micro 6.0:glibc-locale-0:2.38-159998.1.1.x86_64",
          "SUSE Linux Micro 6.0:glibc-locale-base-0:2.38-159998.1.1.aarch64",
          "SUSE Linux Micro 6.0:glibc-locale-base-0:2.38-159998.1.1.s390x",
          "SUSE Linux Micro 6.0:glibc-locale-base-0:2.38-159998.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-8674",
          "url": "https://www.suse.com/security/cve/CVE-2026-8674"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1281297 for CVE-2026-8674",
          "url": "https://bugzilla.suse.com/1281297"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.0:glibc-0:2.38-159998.1.1.aarch64",
            "SUSE Linux Micro 6.0:glibc-0:2.38-159998.1.1.s390x",
            "SUSE Linux Micro 6.0:glibc-0:2.38-159998.1.1.x86_64",
            "SUSE Linux Micro 6.0:glibc-devel-0:2.38-159998.1.1.aarch64",
            "SUSE Linux Micro 6.0:glibc-devel-0:2.38-159998.1.1.s390x",
            "SUSE Linux Micro 6.0:glibc-devel-0:2.38-159998.1.1.x86_64",
            "SUSE Linux Micro 6.0:glibc-locale-0:2.38-159998.1.1.aarch64",
            "SUSE Linux Micro 6.0:glibc-locale-0:2.38-159998.1.1.s390x",
            "SUSE Linux Micro 6.0:glibc-locale-0:2.38-159998.1.1.x86_64",
            "SUSE Linux Micro 6.0:glibc-locale-base-0:2.38-159998.1.1.aarch64",
            "SUSE Linux Micro 6.0:glibc-locale-base-0:2.38-159998.1.1.s390x",
            "SUSE Linux Micro 6.0:glibc-locale-base-0:2.38-159998.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.0:glibc-0:2.38-159998.1.1.aarch64",
            "SUSE Linux Micro 6.0:glibc-0:2.38-159998.1.1.s390x",
            "SUSE Linux Micro 6.0:glibc-0:2.38-159998.1.1.x86_64",
            "SUSE Linux Micro 6.0:glibc-devel-0:2.38-159998.1.1.aarch64",
            "SUSE Linux Micro 6.0:glibc-devel-0:2.38-159998.1.1.s390x",
            "SUSE Linux Micro 6.0:glibc-devel-0:2.38-159998.1.1.x86_64",
            "SUSE Linux Micro 6.0:glibc-locale-0:2.38-159998.1.1.aarch64",
            "SUSE Linux Micro 6.0:glibc-locale-0:2.38-159998.1.1.s390x",
            "SUSE Linux Micro 6.0:glibc-locale-0:2.38-159998.1.1.x86_64",
            "SUSE Linux Micro 6.0:glibc-locale-base-0:2.38-159998.1.1.aarch64",
            "SUSE Linux Micro 6.0:glibc-locale-base-0:2.38-159998.1.1.s390x",
            "SUSE Linux Micro 6.0:glibc-locale-base-0:2.38-159998.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-10-19T08:37:31Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-8674"
    },
    {
      "cve": "CVE-2026-86805",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-86805"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A time-of-check to time-of-use (TOCTOU) race condition in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local attacker to escalate privileges. When expanding $ORIGIN in DT_RPATH for setuid/setgid (AT_SECURE) programs, glibc validates the lexically normalized search path against the trusted directories but then opens the raw, un-normalized path. On systems where the Linux fs.protected_hardlinks sysctl is disabled, a local attacker who hard-links such a program into an attacker-controlled directory and wins a race to replace an intermediate path component with a symbolic link can direct the loader outside the trusted directory, causing it to load an attacker-controlled shared object and execute arbitrary code with the elevated privileges of the program.\n\nExploitation requires an installed setuid or setgid binary whose DT_RPATH uses $ORIGIN followed by \"..\" traversal that normalizes into a trusted directory, and the ability to hard-link that binary and win the race by swapping a path component for a symbolic link. Major Linux-based OS distributions ship with fs.protected_hardlinks enabled by default and mitigate the vulnerability.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.0:glibc-0:2.38-159998.1.1.aarch64",
          "SUSE Linux Micro 6.0:glibc-0:2.38-159998.1.1.s390x",
          "SUSE Linux Micro 6.0:glibc-0:2.38-159998.1.1.x86_64",
          "SUSE Linux Micro 6.0:glibc-devel-0:2.38-159998.1.1.aarch64",
          "SUSE Linux Micro 6.0:glibc-devel-0:2.38-159998.1.1.s390x",
          "SUSE Linux Micro 6.0:glibc-devel-0:2.38-159998.1.1.x86_64",
          "SUSE Linux Micro 6.0:glibc-locale-0:2.38-159998.1.1.aarch64",
          "SUSE Linux Micro 6.0:glibc-locale-0:2.38-159998.1.1.s390x",
          "SUSE Linux Micro 6.0:glibc-locale-0:2.38-159998.1.1.x86_64",
          "SUSE Linux Micro 6.0:glibc-locale-base-0:2.38-159998.1.1.aarch64",
          "SUSE Linux Micro 6.0:glibc-locale-base-0:2.38-159998.1.1.s390x",
          "SUSE Linux Micro 6.0:glibc-locale-base-0:2.38-159998.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-86805",
          "url": "https://www.suse.com/security/cve/CVE-2026-86805"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1282509 for CVE-2026-86805",
          "url": "https://bugzilla.suse.com/1282509"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1282587 for CVE-2026-86805",
          "url": "https://bugzilla.suse.com/1282587"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.0:glibc-0:2.38-159998.1.1.aarch64",
            "SUSE Linux Micro 6.0:glibc-0:2.38-159998.1.1.s390x",
            "SUSE Linux Micro 6.0:glibc-0:2.38-159998.1.1.x86_64",
            "SUSE Linux Micro 6.0:glibc-devel-0:2.38-159998.1.1.aarch64",
            "SUSE Linux Micro 6.0:glibc-devel-0:2.38-159998.1.1.s390x",
            "SUSE Linux Micro 6.0:glibc-devel-0:2.38-159998.1.1.x86_64",
            "SUSE Linux Micro 6.0:glibc-locale-0:2.38-159998.1.1.aarch64",
            "SUSE Linux Micro 6.0:glibc-locale-0:2.38-159998.1.1.s390x",
            "SUSE Linux Micro 6.0:glibc-locale-0:2.38-159998.1.1.x86_64",
            "SUSE Linux Micro 6.0:glibc-locale-base-0:2.38-159998.1.1.aarch64",
            "SUSE Linux Micro 6.0:glibc-locale-base-0:2.38-159998.1.1.s390x",
            "SUSE Linux Micro 6.0:glibc-locale-base-0:2.38-159998.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.0:glibc-0:2.38-159998.1.1.aarch64",
            "SUSE Linux Micro 6.0:glibc-0:2.38-159998.1.1.s390x",
            "SUSE Linux Micro 6.0:glibc-0:2.38-159998.1.1.x86_64",
            "SUSE Linux Micro 6.0:glibc-devel-0:2.38-159998.1.1.aarch64",
            "SUSE Linux Micro 6.0:glibc-devel-0:2.38-159998.1.1.s390x",
            "SUSE Linux Micro 6.0:glibc-devel-0:2.38-159998.1.1.x86_64",
            "SUSE Linux Micro 6.0:glibc-locale-0:2.38-159998.1.1.aarch64",
            "SUSE Linux Micro 6.0:glibc-locale-0:2.38-159998.1.1.s390x",
            "SUSE Linux Micro 6.0:glibc-locale-0:2.38-159998.1.1.x86_64",
            "SUSE Linux Micro 6.0:glibc-locale-base-0:2.38-159998.1.1.aarch64",
            "SUSE Linux Micro 6.0:glibc-locale-base-0:2.38-159998.1.1.s390x",
            "SUSE Linux Micro 6.0:glibc-locale-base-0:2.38-159998.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-10-19T08:37:31Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-86805"
    },
    {
      "cve": "CVE-2026-89092",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-89092"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The nscd service in the GNU C Library 2.3.4 onwards may crash due to a \nstack overflow when a malicious DNS server returns too large a response \nfor a DNS query, resulting in degraded DNS resolution for the system.\n\n\n\nExploitation of this bug needs a system that has nscd enabled and using \nan untrusted DNS server for name resolution, with the compromised DNS \nserver being capable of processing records large enough to result in a \nstack overflow in an nscd thread stack.   During experimentation, bind 9 \nwas unable to handle large records, but that could change in future or \nwith a different name server.   In typical installations, nscd is \nexecuted in an isolated context as its own user without a shell, due to \nwhich any compromise of that service is isolated.\n\n\n\nThere is a remote possibility of nscd cache corruption if an attacker \nmanages to get the stack pointer into a desired point in the heap, \npotentially resulting in other caches in nscd being overwritten with \ncorrupt data through the stack overflow, until the buggy code path \neventually results in a crash.\n\n\n\nFinally, a crash in nscd may result in performance degradation when \nresolving names, but it does not result in a denial of service.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.0:glibc-0:2.38-159998.1.1.aarch64",
          "SUSE Linux Micro 6.0:glibc-0:2.38-159998.1.1.s390x",
          "SUSE Linux Micro 6.0:glibc-0:2.38-159998.1.1.x86_64",
          "SUSE Linux Micro 6.0:glibc-devel-0:2.38-159998.1.1.aarch64",
          "SUSE Linux Micro 6.0:glibc-devel-0:2.38-159998.1.1.s390x",
          "SUSE Linux Micro 6.0:glibc-devel-0:2.38-159998.1.1.x86_64",
          "SUSE Linux Micro 6.0:glibc-locale-0:2.38-159998.1.1.aarch64",
          "SUSE Linux Micro 6.0:glibc-locale-0:2.38-159998.1.1.s390x",
          "SUSE Linux Micro 6.0:glibc-locale-0:2.38-159998.1.1.x86_64",
          "SUSE Linux Micro 6.0:glibc-locale-base-0:2.38-159998.1.1.aarch64",
          "SUSE Linux Micro 6.0:glibc-locale-base-0:2.38-159998.1.1.s390x",
          "SUSE Linux Micro 6.0:glibc-locale-base-0:2.38-159998.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-89092",
          "url": "https://www.suse.com/security/cve/CVE-2026-89092"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1282449 for CVE-2026-89092",
          "url": "https://bugzilla.suse.com/1282449"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.0:glibc-0:2.38-159998.1.1.aarch64",
            "SUSE Linux Micro 6.0:glibc-0:2.38-159998.1.1.s390x",
            "SUSE Linux Micro 6.0:glibc-0:2.38-159998.1.1.x86_64",
            "SUSE Linux Micro 6.0:glibc-devel-0:2.38-159998.1.1.aarch64",
            "SUSE Linux Micro 6.0:glibc-devel-0:2.38-159998.1.1.s390x",
            "SUSE Linux Micro 6.0:glibc-devel-0:2.38-159998.1.1.x86_64",
            "SUSE Linux Micro 6.0:glibc-locale-0:2.38-159998.1.1.aarch64",
            "SUSE Linux Micro 6.0:glibc-locale-0:2.38-159998.1.1.s390x",
            "SUSE Linux Micro 6.0:glibc-locale-0:2.38-159998.1.1.x86_64",
            "SUSE Linux Micro 6.0:glibc-locale-base-0:2.38-159998.1.1.aarch64",
            "SUSE Linux Micro 6.0:glibc-locale-base-0:2.38-159998.1.1.s390x",
            "SUSE Linux Micro 6.0:glibc-locale-base-0:2.38-159998.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.0:glibc-0:2.38-159998.1.1.aarch64",
            "SUSE Linux Micro 6.0:glibc-0:2.38-159998.1.1.s390x",
            "SUSE Linux Micro 6.0:glibc-0:2.38-159998.1.1.x86_64",
            "SUSE Linux Micro 6.0:glibc-devel-0:2.38-159998.1.1.aarch64",
            "SUSE Linux Micro 6.0:glibc-devel-0:2.38-159998.1.1.s390x",
            "SUSE Linux Micro 6.0:glibc-devel-0:2.38-159998.1.1.x86_64",
            "SUSE Linux Micro 6.0:glibc-locale-0:2.38-159998.1.1.aarch64",
            "SUSE Linux Micro 6.0:glibc-locale-0:2.38-159998.1.1.s390x",
            "SUSE Linux Micro 6.0:glibc-locale-0:2.38-159998.1.1.x86_64",
            "SUSE Linux Micro 6.0:glibc-locale-base-0:2.38-159998.1.1.aarch64",
            "SUSE Linux Micro 6.0:glibc-locale-base-0:2.38-159998.1.1.s390x",
            "SUSE Linux Micro 6.0:glibc-locale-base-0:2.38-159998.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-10-19T08:37:31Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-89092"
    },
    {
      "cve": "CVE-2026-97399",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-97399"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The strncasecmp function in the GNU C Library 2.24 and later optimized for the Power8 architecture may read one byte beyond the input size limit, which may crash a program when that byte is not readable.\n\nThis condition may happen when the input strings to the strncasecmp function are attacker controlled in an application and they match all the way up to the edge of their page and the neighbouring page is either not mapped or is not readable.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.0:glibc-0:2.38-159998.1.1.aarch64",
          "SUSE Linux Micro 6.0:glibc-0:2.38-159998.1.1.s390x",
          "SUSE Linux Micro 6.0:glibc-0:2.38-159998.1.1.x86_64",
          "SUSE Linux Micro 6.0:glibc-devel-0:2.38-159998.1.1.aarch64",
          "SUSE Linux Micro 6.0:glibc-devel-0:2.38-159998.1.1.s390x",
          "SUSE Linux Micro 6.0:glibc-devel-0:2.38-159998.1.1.x86_64",
          "SUSE Linux Micro 6.0:glibc-locale-0:2.38-159998.1.1.aarch64",
          "SUSE Linux Micro 6.0:glibc-locale-0:2.38-159998.1.1.s390x",
          "SUSE Linux Micro 6.0:glibc-locale-0:2.38-159998.1.1.x86_64",
          "SUSE Linux Micro 6.0:glibc-locale-base-0:2.38-159998.1.1.aarch64",
          "SUSE Linux Micro 6.0:glibc-locale-base-0:2.38-159998.1.1.s390x",
          "SUSE Linux Micro 6.0:glibc-locale-base-0:2.38-159998.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-97399",
          "url": "https://www.suse.com/security/cve/CVE-2026-97399"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1283147 for CVE-2026-97399",
          "url": "https://bugzilla.suse.com/1283147"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.0:glibc-0:2.38-159998.1.1.aarch64",
            "SUSE Linux Micro 6.0:glibc-0:2.38-159998.1.1.s390x",
            "SUSE Linux Micro 6.0:glibc-0:2.38-159998.1.1.x86_64",
            "SUSE Linux Micro 6.0:glibc-devel-0:2.38-159998.1.1.aarch64",
            "SUSE Linux Micro 6.0:glibc-devel-0:2.38-159998.1.1.s390x",
            "SUSE Linux Micro 6.0:glibc-devel-0:2.38-159998.1.1.x86_64",
            "SUSE Linux Micro 6.0:glibc-locale-0:2.38-159998.1.1.aarch64",
            "SUSE Linux Micro 6.0:glibc-locale-0:2.38-159998.1.1.s390x",
            "SUSE Linux Micro 6.0:glibc-locale-0:2.38-159998.1.1.x86_64",
            "SUSE Linux Micro 6.0:glibc-locale-base-0:2.38-159998.1.1.aarch64",
            "SUSE Linux Micro 6.0:glibc-locale-base-0:2.38-159998.1.1.s390x",
            "SUSE Linux Micro 6.0:glibc-locale-base-0:2.38-159998.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.0:glibc-0:2.38-159998.1.1.aarch64",
            "SUSE Linux Micro 6.0:glibc-0:2.38-159998.1.1.s390x",
            "SUSE Linux Micro 6.0:glibc-0:2.38-159998.1.1.x86_64",
            "SUSE Linux Micro 6.0:glibc-devel-0:2.38-159998.1.1.aarch64",
            "SUSE Linux Micro 6.0:glibc-devel-0:2.38-159998.1.1.s390x",
            "SUSE Linux Micro 6.0:glibc-devel-0:2.38-159998.1.1.x86_64",
            "SUSE Linux Micro 6.0:glibc-locale-0:2.38-159998.1.1.aarch64",
            "SUSE Linux Micro 6.0:glibc-locale-0:2.38-159998.1.1.s390x",
            "SUSE Linux Micro 6.0:glibc-locale-0:2.38-159998.1.1.x86_64",
            "SUSE Linux Micro 6.0:glibc-locale-base-0:2.38-159998.1.1.aarch64",
            "SUSE Linux Micro 6.0:glibc-locale-base-0:2.38-159998.1.1.s390x",
            "SUSE Linux Micro 6.0:glibc-locale-base-0:2.38-159998.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-10-19T08:37:31Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-97399"
    }
  ]
}

CVE-2026-8674 (GCVE-0-2026-8674)

Vulnerability from cvelistv5 – Published: 2026-09-17 16:54 – Updated: 2026-09-17 18:09

Title

Assertion failure in the DNS stub resolver with a long search domain

Summary

Initializing the DNS stub resolver from an /etc/resolv.conf file, or a LOCALDOMAIN environment variable, whose search list contains a domain of roughly 200 characters or more in the GNU C Library version 2.26 to 2.44 results in an assertion failure which aborts the process. The resolver truncates the search list when copying it into the fixed-size _res.defdname buffer, then asserts that the copy is consistent with the full configuration. The consistency check compared against the wrong size and did not handle a first entry that does not fit, so a correctly truncated list failed the assertion. Any process that resolves names through the library is affected, including long-running processes that reload /etc/resolv.conf on the next query after it changes. Search domains are commonly written to /etc/resolv.conf from data received over DHCP or from a VPN server, so an attacker on the local network may be able to trigger this without privileges on the target system, subject to validation by the network configuration software.

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-17 18:05 UTC

CWE

CWE-617 - Reachable Assertion

Assigner

glibc CNA under the redhat root

CNA scorecard B 80/100 over 12 records in the last 180 days details

References

5 references

URL	Tags
https://sourceware.org/bugzilla/show_bug.cgi?id=31026	issue-tracking
https://sourceware.org/git/?p=glibc.git;a=blob_pl…	vendor-advisory
https://sourceware.org/git/?p=glibc.git;a=commit;…	patch
https://joshua.hu/fuzzing-glibc-libresolv	technical-description
http://www.openwall.com/lists/oss-security/2026/09/17/4

Impacted products

1 product

Vendor	Product	Version
The GNU C Library	glibc	Affected: 2.26 , ≤ 2.44 (custom)

Date Public

2023-11-07 05:00

Credits

Joshua Rogers

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-8674",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-17T18:05:54.714741Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-17T18:06:00.631Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2026-09-17T18:09:16.072Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/09/17/4"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "glibc",
          "vendor": "The GNU C Library",
          "versions": [
            {
              "lessThanOrEqual": "2.44",
              "status": "affected",
              "version": "2.26",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Joshua Rogers"
        }
      ],
      "datePublic": "2023-11-07T05:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Initializing the DNS stub resolver from an /etc/resolv.conf file, or a LOCALDOMAIN environment variable, whose search list contains a domain of roughly 200 characters or more in the GNU C Library version 2.26 to 2.44 results in an assertion failure which aborts the process.\u003cbr\u003e\u003cbr\u003eThe resolver truncates the search list when copying it into the fixed-size _res.defdname buffer, then asserts that the copy is consistent with the full configuration.  The consistency check compared against the wrong size and did not handle a first entry that does not fit, so a correctly truncated list failed the assertion.  Any process that resolves names through the library is affected, including long-running processes that reload /etc/resolv.conf on the next query after it changes.  Search domains are commonly written to /etc/resolv.conf from data received over DHCP or from a VPN server, so an attacker on the local network may be able to trigger this without privileges on the target system, subject to validation by the network configuration software."
            }
          ],
          "value": "Initializing the DNS stub resolver from an /etc/resolv.conf file, or a LOCALDOMAIN environment variable, whose search list contains a domain of roughly 200 characters or more in the GNU C Library version 2.26 to 2.44 results in an assertion failure which aborts the process.\n\nThe resolver truncates the search list when copying it into the fixed-size _res.defdname buffer, then asserts that the copy is consistent with the full configuration.  The consistency check compared against the wrong size and did not handle a first entry that does not fit, so a correctly truncated list failed the assertion.  Any process that resolves names through the library is affected, including long-running processes that reload /etc/resolv.conf on the next query after it changes.  Search domains are commonly written to /etc/resolv.conf from data received over DHCP or from a VPN server, so an attacker on the local network may be able to trigger this without privileges on the target system, subject to validation by the network configuration software."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-617",
              "description": "CWE-617 Reachable Assertion",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-17T16:54:27.310Z",
        "orgId": "3ff69d7a-14f2-4f67-a097-88dee7810d18",
        "shortName": "glibc"
      },
      "references": [
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=31026"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0021"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://sourceware.org/git/?p=glibc.git;a=commit;h=506ea57086bfb9ce3daff1c14246a1cb532aba0a"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://joshua.hu/fuzzing-glibc-libresolv"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Assertion failure in the DNS stub resolver with a long search domain",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "3ff69d7a-14f2-4f67-a097-88dee7810d18",
    "assignerShortName": "glibc",
    "cveId": "CVE-2026-8674",
    "datePublished": "2026-09-17T16:54:27.310Z",
    "dateReserved": "2026-05-15T12:15:59.229Z",
    "dateUpdated": "2026-09-17T18:09:16.072Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-86805 (GCVE-0-2026-86805)

Vulnerability from cvelistv5 – Published: 2026-09-22 15:55 – Updated: 2026-09-23 03:55

Title

AT_SECURE programs may load attacker-controlled code via $ORIGIN

Summary

A time-of-check to time-of-use (TOCTOU) race condition in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local attacker to escalate privileges. When expanding $ORIGIN in DT_RPATH for setuid/setgid (AT_SECURE) programs, glibc validates the lexically normalized search path against the trusted directories but then opens the raw, un-normalized path. On systems where the Linux fs.protected_hardlinks sysctl is disabled, a local attacker who hard-links such a program into an attacker-controlled directory and wins a race to replace an intermediate path component with a symbolic link can direct the loader outside the trusted directory, causing it to load an attacker-controlled shared object and execute arbitrary code with the elevated privileges of the program. Exploitation requires an installed setuid or setgid binary whose DT_RPATH uses $ORIGIN followed by ".." traversal that normalizes into a trusted directory, and the ability to hard-link that binary and win the race by swapping a path component for a symbolic link. Major Linux-based OS distributions ship with fs.protected_hardlinks enabled by default and mitigate the vulnerability.

Severity

6.3 (Medium)


                        
                          CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-22 00:00 UTC

CWE

CWE-367 - Time-of-check time-of-use (TOCTOU) race condition

Assigner

glibc CNA under the redhat root

CNA scorecard B 80/100 over 12 records in the last 180 days details

References

2 references

URL	Tags
https://sourceware.org/bugzilla/show_bug.cgi?id=34360	issue-tracking
https://sourceware.org/git/?p=glibc.git;a=blob_pl…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
The GNU C Library	glibc	Affected: 2.14 , < 2.45 (custom)

Credits

Jann Horn

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-86805",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-22T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-23T03:55:58.505Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "glibc",
          "vendor": "The GNU C Library",
          "versions": [
            {
              "lessThan": "2.45",
              "status": "affected",
              "version": "2.14",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Jann Horn"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A time-of-check to time-of-use (TOCTOU) race condition in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local attacker to escalate privileges. When expanding $ORIGIN in DT_RPATH for setuid/setgid (AT_SECURE) programs, glibc validates the lexically normalized search path against the trusted directories but then opens the raw, un-normalized path. On systems where the Linux fs.protected_hardlinks sysctl is disabled, a local attacker who hard-links such a program into an attacker-controlled directory and wins a race to replace an intermediate path component with a symbolic link can direct the loader outside the trusted directory, causing it to load an attacker-controlled shared object and execute arbitrary code with the elevated privileges of the program.\u003cbr\u003e\u003cbr\u003eExploitation requires an installed setuid or setgid binary whose DT_RPATH uses $ORIGIN followed by \"..\" traversal that normalizes into a trusted directory, and the ability to hard-link that binary and win the race by swapping a path component for a symbolic link. Major Linux-based OS distributions ship with fs.protected_hardlinks enabled by default and mitigate the vulnerability."
            }
          ],
          "value": "A time-of-check to time-of-use (TOCTOU) race condition in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local attacker to escalate privileges. When expanding $ORIGIN in DT_RPATH for setuid/setgid (AT_SECURE) programs, glibc validates the lexically normalized search path against the trusted directories but then opens the raw, un-normalized path. On systems where the Linux fs.protected_hardlinks sysctl is disabled, a local attacker who hard-links such a program into an attacker-controlled directory and wins a race to replace an intermediate path component with a symbolic link can direct the loader outside the trusted directory, causing it to load an attacker-controlled shared object and execute arbitrary code with the elevated privileges of the program.\n\nExploitation requires an installed setuid or setgid binary whose DT_RPATH uses $ORIGIN followed by \"..\" traversal that normalizes into a trusted directory, and the ability to hard-link that binary and win the race by swapping a path component for a symbolic link. Major Linux-based OS distributions ship with fs.protected_hardlinks enabled by default and mitigate the vulnerability."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-233",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-233 Privilege Escalation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-367",
              "description": "CWE-367 Time-of-check time-of-use (TOCTOU) race condition",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-22T16:42:16.362Z",
        "orgId": "3ff69d7a-14f2-4f67-a097-88dee7810d18",
        "shortName": "glibc"
      },
      "references": [
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=34360"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0022"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "AT_SECURE programs may load attacker-controlled code via $ORIGIN",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "3ff69d7a-14f2-4f67-a097-88dee7810d18",
    "assignerShortName": "glibc",
    "cveId": "CVE-2026-86805",
    "datePublished": "2026-09-22T15:55:17.117Z",
    "dateReserved": "2026-09-08T12:56:00.982Z",
    "dateUpdated": "2026-09-23T03:55:58.505Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-89092 (GCVE-0-2026-89092)

Vulnerability from cvelistv5 – Published: 2026-09-11 01:23 – Updated: 2026-09-11 17:02

Title

Stack overflow in nscd due to unbounded alloca use

Summary

The nscd service in the GNU C Library 2.3.4 onwards may crash due to a stack overflow when a malicious DNS server returns too large a response for a DNS query, resulting in degraded DNS resolution for the system. Exploitation of this bug needs a system that has nscd enabled and using an untrusted DNS server for name resolution, with the compromised DNS server being capable of processing records large enough to result in a stack overflow in an nscd thread stack. During experimentation, bind 9 was unable to handle large records, but that could change in future or with a different name server. In typical installations, nscd is executed in an isolated context as its own user without a shell, due to which any compromise of that service is isolated. There is a remote possibility of nscd cache corruption if an attacker manages to get the stack pointer into a desired point in the heap, potentially resulting in other caches in nscd being overwritten with corrupt data through the stack overflow, until the buggy code path eventually results in a crash. Finally, a crash in nscd may result in performance degradation when resolving names, but it does not result in a denial of service.

Severity

4.2 (Medium)


                        
                          CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-11 16:57 UTC

CWE

CWE-789 - Memory allocation with excessive size value

Assigner

glibc CNA under the redhat root

CNA scorecard B 80/100 over 12 records in the last 180 days details

References

3 references

URL	Tags
https://sourceware.org/bugzilla/show_bug.cgi?id=34624	issue-tracking
https://sourceware.org/git/?p=glibc.git;a=blob_pl…	vendor-advisory
http://www.openwall.com/lists/oss-security/2026/09/11/2

Impacted products

1 product

Vendor	Product	Version
The GNU C Library	glibc	Affected: 2.3.4 , < 2.45 (custom)

Credits

Anmol Singh Rajput

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-09-11T03:09:09.108Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/09/11/2"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-89092",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-11T16:57:22.665457Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-11T17:02:18.288Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "glibc",
          "vendor": "The GNU C Library",
          "versions": [
            {
              "lessThan": "2.45",
              "status": "affected",
              "version": "2.3.4",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Anmol Singh Rajput"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "The nscd service in the GNU C Library 2.3.4 onwards may crash due to a \nstack overflow when a malicious DNS server returns too large a response \nfor a DNS query, resulting in degraded DNS resolution for the system.\n\u003cbr\u003e\n\u003cbr\u003eExploitation of this bug needs a system that has nscd enabled and using \nan untrusted DNS server for name resolution, with the compromised DNS \nserver being capable of processing records large enough to result in a \nstack overflow in an nscd thread stack.\u0026nbsp; During experimentation, bind 9 \nwas unable to handle large records, but that could change in future or \nwith a different name server.\u0026nbsp; In typical installations, nscd is \nexecuted in an isolated context as its own user without a shell, due to \nwhich any compromise of that service is isolated.\n\u003cbr\u003e\n\u003cbr\u003eThere is a remote possibility of nscd cache corruption if an attacker \nmanages to get the stack pointer into a desired point in the heap, \npotentially resulting in other caches in nscd being overwritten with \ncorrupt data through the stack overflow, until the buggy code path \neventually results in a crash.\n\u003cbr\u003e\n\u003cbr\u003eFinally, a crash in nscd may result in performance degradation when \nresolving names, but it does not result in a denial of service.\u0026nbsp;"
            }
          ],
          "value": "The nscd service in the GNU C Library 2.3.4 onwards may crash due to a \nstack overflow when a malicious DNS server returns too large a response \nfor a DNS query, resulting in degraded DNS resolution for the system.\n\n\n\nExploitation of this bug needs a system that has nscd enabled and using \nan untrusted DNS server for name resolution, with the compromised DNS \nserver being capable of processing records large enough to result in a \nstack overflow in an nscd thread stack.\u00a0 During experimentation, bind 9 \nwas unable to handle large records, but that could change in future or \nwith a different name server.\u00a0 In typical installations, nscd is \nexecuted in an isolated context as its own user without a shell, due to \nwhich any compromise of that service is isolated.\n\n\n\nThere is a remote possibility of nscd cache corruption if an attacker \nmanages to get the stack pointer into a desired point in the heap, \npotentially resulting in other caches in nscd being overwritten with \ncorrupt data through the stack overflow, until the buggy code path \neventually results in a crash.\n\n\n\nFinally, a crash in nscd may result in performance degradation when \nresolving names, but it does not result in a denial of service."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-142",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-142 DNS Cache Poisoning"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 4.2,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-789",
              "description": "CWE-789 Memory allocation with excessive size value",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T01:23:01.162Z",
        "orgId": "3ff69d7a-14f2-4f67-a097-88dee7810d18",
        "shortName": "glibc"
      },
      "references": [
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=34624"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0016"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Stack overflow in nscd due to unbounded alloca use",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "3ff69d7a-14f2-4f67-a097-88dee7810d18",
    "assignerShortName": "glibc",
    "cveId": "CVE-2026-89092",
    "datePublished": "2026-09-11T01:23:01.162Z",
    "dateReserved": "2026-09-10T20:18:09.584Z",
    "dateUpdated": "2026-09-11T17:02:18.288Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-97399 (GCVE-0-2026-97399)

Vulnerability from cvelistv5 – Published: 2026-09-28 15:21 – Updated: 2026-09-28 17:07

Title

One-byte overread in strncasecmp on Power8

Summary

The strncasecmp function in the GNU C Library 2.24 and later optimized for the Power8 architecture may read one byte beyond the input size limit, which may crash a program when that byte is not readable. This condition may happen when the input strings to the strncasecmp function are attacker controlled in an application and they match all the way up to the edge of their page and the neighbouring page is either not mapped or is not readable.

Severity

3.7 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-28 15:33 UTC

CWE

CWE-126 - Buffer over-read

Assigner

glibc CNA under the redhat root

CNA scorecard B 80/100 over 12 records in the last 180 days details

References

3 references

URL	Tags
https://sourceware.org/bugzilla/show_bug.cgi?id=34683	issue-tracking
https://sourceware.org/git/?p=glibc.git;a=blob_pl…	vendor-advisory
http://www.openwall.com/lists/oss-security/2026/09/28/7

Impacted products

1 product

Vendor	Product	Version
The GNU C Library	glibc	Affected: 2.24 , < 2.45 (custom)

Credits

AISLE in partnership with Red Hat

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-97399",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-28T15:33:28.320527Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-28T16:22:25.647Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2026-09-28T17:07:36.744Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/09/28/7"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Power8"
          ],
          "product": "glibc",
          "vendor": "The GNU C Library",
          "versions": [
            {
              "lessThan": "2.45",
              "status": "affected",
              "version": "2.24",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "AISLE in partnership with Red Hat"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "The strncasecmp function in the GNU C Library 2.24 and later optimized for the Power8 architecture may read one byte beyond the input size limit, which may crash a program when that byte is not readable.\u003cbr\u003e\u003cbr\u003eThis condition may happen when the input strings to the strncasecmp function are attacker controlled in an application and they match all the way up to the edge of their page and the neighbouring page is either not mapped or is not readable."
            }
          ],
          "value": "The strncasecmp function in the GNU C Library 2.24 and later optimized for the Power8 architecture may read one byte beyond the input size limit, which may crash a program when that byte is not readable.\n\nThis condition may happen when the input strings to the strncasecmp function are attacker controlled in an application and they match all the way up to the edge of their page and the neighbouring page is either not mapped or is not readable."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-540",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-540 Overread Buffers"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-126",
              "description": "CWE-126 Buffer over-read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-28T15:21:02.090Z",
        "orgId": "3ff69d7a-14f2-4f67-a097-88dee7810d18",
        "shortName": "glibc"
      },
      "references": [
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=34683"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0024"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "One-byte overread in strncasecmp on Power8",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "3ff69d7a-14f2-4f67-a097-88dee7810d18",
    "assignerShortName": "glibc",
    "cveId": "CVE-2026-97399",
    "datePublished": "2026-09-28T15:21:02.090Z",
    "dateReserved": "2026-09-24T14:30:14.230Z",
    "dateUpdated": "2026-09-28T17:07:36.744Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

SUSE-SU-2026:24326-1

CVE-2026-8674 (GCVE-0-2026-8674)

CVE-2026-86805 (GCVE-0-2026-86805)

CVE-2026-89092 (GCVE-0-2026-89092)

CVE-2026-97399 (GCVE-0-2026-97399)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour