Read the docs
TI-2025-05141 Aliases CVE-2025-5702GHSA-hqwp-qwfv-mhrx

The strcmp implementation optimized for the Power10 processor in the GNU C Library…

Priority MEDIUM 58CWE-665Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
Low · Low · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat.

Summary

The strcmp implementation optimized for the Power10 processor in the GNU C Library version 2.39 and later writes to vector registers v20 to v31 without saving contents from the caller (those registers are defined as non-volatile registers by the powerpc64le ABI), resulting in overwriting of its contents and potentially altering control flow of the caller, or leaking the input strings to the function to other parts of the program.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00319 25th percentileScored 2026-11-07
Fix Fixed Red Hat: 3 advisories

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
GNUglibc2.39—No fix listedCNA
  • glibc VendorGNU Affected 2.39 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:gnu:glibc:*:*:*:*:*:*:*:*2.39 to before 2.39-209; 2.40 to before 2.40-139; 2.41 to before 2.41-60VulnerableGNU
  • cpe:2.3:a:gnu:glibc:*:*:*:*:*:*:*:* Versions 2.39 to before 2.39-209; 2.40 to before 2.40-139; 2.41 to before 2.41-60 Vulnerable ·GNU

Remediation

Red Hat 3 advisories

  • RHSA-2025:11487 Released 2025-07-21 · Red Hat rating Important
    A Subscription Management tool for finding and reporting Red Hat product usage
    • Red Hat Discovery 2 registry.redhat.io/discovery/discovery-server-rhel9
  • RHSA-2025:11066 Released 2025-07-15 · Red Hat rating Moderate
    glibc security update
    • Red Hat Enterprise Linux AppStream (v. 10) glibc-devel-2.39-43.el10_0, glibc-doc-2.39-43.el10_0, glibc-locale-source-2.39-43.el10_0 +1
    • Red Hat Enterprise Linux BaseOS (v. 10) glibc-2.39-43.el10_0, glibc-all-langpacks-2.39-43.el10_0, glibc-common-2.39-43.el10_0 +47
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) glibc-benchtests-2.39-43.el10_0, glibc-nss-devel-2.39-43.el10_0, glibc-static-2.39-43.el10_0 +2
  • RHSA-2025:9877 Released 2025-06-30 · Red Hat rating Moderate
    glibc security update
    • Red Hat Enterprise Linux AppStream (v. 9) glibc-devel-2.34-168.el9_6.20, glibc-doc-2.34-168.el9_6.20, glibc-headers-2.34-168.el9_6.20 +2
    • Red Hat Enterprise Linux BaseOS (v. 9) glibc-2.34-168.el9_6.20, glibc-all-langpacks-2.34-168.el9_6.20, glibc-common-2.34-168.el9_6.20 +47
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) glibc-benchtests-2.34-168.el9_6.20, glibc-nss-devel-2.34-168.el9_6.20, glibc-static-2.34-168.el9_6.20 +2

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Discovery 2Fixed RHSA-2025:11487
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2025:11066
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2025:9877
Red Hat Enterprise Linux BaseOS (v. 10)Fixed RHSA-2025:11066
Red Hat Enterprise Linux BaseOS (v. 9)Fixed RHSA-2025:9877
Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)Fixed RHSA-2025:11066
Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)Fixed RHSA-2025:9877
Not affected: 4 products
  • Red Hat Discovery 2
  • Red Hat Enterprise Linux 6
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-5702
  2. 2026-10-03 Alias added: GHSA-hqwp-qwfv-mhrx

References

Other 1

  • TI-2023-04522 Glibc: buffer overflow in ld.so leading to privilege escalation KEVCVSS 3.1HIGH 7.8
  • TI-2015-00205 Heap-based buffer overflow in the __nss_hostname_digits_dots function in glibc 2.2, and… CVSS 2.0HIGH 10.0
  • TI-2026-04772 scanf %mc off-by-one heap buffer overflow CVSS 3.1CRITICAL 9.8
  • TI-2022-07360 The deprecated compatibility function clnt_create in the sunrpc module of the GNU C… CVSS 3.1CRITICAL 9.8
  • TI-2022-07359 The deprecated compatibility function svcunix_create in the sunrpc module of the GNU C… CVSS 3.1CRITICAL 9.8
  • TI-2015-06274 Multiple stack-based buffer overflows in the (1) send_dg and (2) send_vc functions in the… CVSS 3.0HIGH 8.1
See all 162 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences