The GNU C Library security advisory update for 2026-09-28
GNU C Library Power8 strncasecmp can overread one byte and crash when inputs are attacker-controlled.
The GNU C Library project published GLIBC-SA-2026-0024, covering a one-byte overread in the Power8-optimized strncasecmp implementation. In glibc 2.24 and later, strncasecmp may read one byte past the stated input size. If that byte is not readable, the program can crash, and the condition can occur when the input strings are attacker-controlled. The notice does not cite a CVE or report exploitation.
- GLIBC-SA-2026-0024 describes a one-byte overread in Power8 strncasecmp.
- GNU C Library 2.24 and later are affected on the Power8 optimization.
- An unreadable extra byte can crash the program when inputs are attacker-controlled.
- No CVE identifier is included in the posted advisory.
- Vendors
- GNU Project
- Products
- glibc
- Organizations
- GNU Project
From the original article
Posted by Siddhesh Poyarekar on Sep 28 The following security advisories have been published: GLIBC-SA-2026-0024: =================== One-byte overread in strncasecmp on Power8 The strncasecmp function in the GNU C Library 2. 24 and later optimized for the Power8 architecture may read one byte beyond the input size limit, which may crash a program when that byte is not readable.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.