CVE-2026-97399

A flaw was found in glibc. In builds optimized for specific hardware architectures, the string comparison function strncasecmp may read one byte beyond the boundary of the provided input string. An attacker capable of passing controlled strings that end at the edge of a memory page could trigger an invalid memory access and crash the application, resulting in a Denial of Service (DoS).

This vulnerability is rated as having a Low impact because exploitation is constrained to Power8 hardware architectures and demands exceptionally rare runtime conditions to trigger. Successful triggering requires input strings to be positioned precisely at the end of a mapped memory page with an unmapped adjacent page, limiting the outcome to an application crash without enabling code execution or unauthorized data disclosure. Systems deployed on other CPU architectures do not utilize this specific implementation and remain unaffected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.