https://seclists.org/oss-sec/2026/q3/966: The GNU C Library security advisory update for 2026-09-28
Published Sep 28, 2026
·Updated
Affected Software
1 affected component
GNU GNU C Library>=2.24
Frequently Asked Questions
1
Which systems are affected by this issue?
The issue affects GNU C Library 2.24 and later when using the strncasecmp implementation optimized for the Power8 architecture. Other architectures are not identified as affected in the advisory.
2
What conditions are required for an attacker to trigger the crash?
An application must call strncasecmp on attacker-controlled input strings that match up to the edge of a memory page. The following page must be unmapped or unreadable for the one-byte overread to crash the program.
3
What is the likely security impact?
The advisory describes a potential program crash from reading one byte past the specified input limit. It assigns CVSS 3.7 and identifies availability impact only, with no confidentiality or integrity impact.