CVE catalog

CVE-2025-5745

GNU C Library vulnerabilities

Severity: High · CVSS 8.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Published: Jun 5, 2025, 7:20:23 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.25% · Oct 25, 2026

The strncmp implementation optimized for the Power10 processor in the GNU C Library version 2.40 and later writes to vector registers v20 to v31 without saving contents from the caller (those registers are defined as non-volatile registers by the powerpc64le ABI), resulting in overwriting of its contents and potentially altering control flow of the caller, or leaking the input strings to the function to other parts of the program.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	glibc	sid	`2.43-7`	fixed
Debian	glibc	forky	`2.43-7`	fixed
Debian	glibc	trixie	`2.41-12+deb13u4`	fixed
Debian	glibc	bookworm	`2.36-9+deb12u14`	not affected
Debian	glibc	bookworm-security	`2.36-9+deb12u7`	not affected
Ubuntu	glibc	noble	Not reported	not affected
Ubuntu	glibc	noble	`2.39-0ubuntu8.5`	fixed
Ubuntu	glibc-doc	noble	`2.39-0ubuntu8.5`	fixed
Ubuntu	glibc-source	noble	`2.39-0ubuntu8.5`	fixed
Ubuntu	libc-bin	noble	`2.39-0ubuntu8.5`	fixed
Ubuntu	libc-dev-bin	noble	`2.39-0ubuntu8.5`	fixed
Ubuntu	libc-devtools	noble	`2.39-0ubuntu8.5`	fixed
Ubuntu	libc6	noble	`2.39-0ubuntu8.5`	fixed
Ubuntu	libc6-amd64	noble	`2.39-0ubuntu8.5`	fixed
Ubuntu	libc6-dev	noble	`2.39-0ubuntu8.5`	fixed
Ubuntu	libc6-dev-amd64	noble	`2.39-0ubuntu8.5`	fixed
Ubuntu	libc6-dev-i386	noble	`2.39-0ubuntu8.5`	fixed
Ubuntu	libc6-dev-s390	noble	`2.39-0ubuntu8.5`	fixed
Ubuntu	libc6-dev-x32	noble	`2.39-0ubuntu8.5`	fixed
Ubuntu	libc6-i386	noble	`2.39-0ubuntu8.5`	fixed
Ubuntu	libc6-s390	noble	`2.39-0ubuntu8.5`	fixed
Ubuntu	libc6-x32	noble	`2.39-0ubuntu8.5`	fixed
Ubuntu	locales	noble	`2.39-0ubuntu8.5`	fixed
Ubuntu	locales-all	noble	`2.39-0ubuntu8.5`	fixed
Ubuntu	nscd	noble	`2.39-0ubuntu8.5`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	glibc	source	sid	`2.41-9`	not yet assigned	Not reported	[1107366]
Debian	glibc	source	forky	`2.41-9`	not yet assigned	Not reported	[1107366]
Debian	glibc	source	trixie	`2.41-9`	not yet assigned	Not reported	[1107366]
Debian	glibc	source	bookworm	`Not affected`	unimportant	Not reported	[1107366]
Ubuntu	glibc	deb	noble	`2.39-0ubuntu8.5`	Not reported	Not reported	Not reported
Ubuntu	glibc-doc	deb	noble	`2.39-0ubuntu8.5`	Not reported	Not reported	Not reported
Ubuntu	glibc-source	deb	noble	`2.39-0ubuntu8.5`	Not reported	Not reported	Not reported
Ubuntu	libc-bin	deb	noble	`2.39-0ubuntu8.5`	Not reported	Not reported	Not reported
Ubuntu	libc-dev-bin	deb	noble	`2.39-0ubuntu8.5`	Not reported	Not reported	Not reported
Ubuntu	libc-devtools	deb	noble	`2.39-0ubuntu8.5`	Not reported	Not reported	Not reported
Ubuntu	libc6	deb	noble	`2.39-0ubuntu8.5`	Not reported	Not reported	Not reported
Ubuntu	libc6-amd64	deb	noble	`2.39-0ubuntu8.5`	Not reported	Not reported	Not reported
Ubuntu	libc6-dev	deb	noble	`2.39-0ubuntu8.5`	Not reported	Not reported	Not reported
Ubuntu	libc6-dev-amd64	deb	noble	`2.39-0ubuntu8.5`	Not reported	Not reported	Not reported
Ubuntu	libc6-dev-i386	deb	noble	`2.39-0ubuntu8.5`	Not reported	Not reported	Not reported
Ubuntu	libc6-dev-s390	deb	noble	`2.39-0ubuntu8.5`	Not reported	Not reported	Not reported
Ubuntu	libc6-dev-x32	deb	noble	`2.39-0ubuntu8.5`	Not reported	Not reported	Not reported
Ubuntu	libc6-i386	deb	noble	`2.39-0ubuntu8.5`	Not reported	Not reported	Not reported
Ubuntu	libc6-s390	deb	noble	`2.39-0ubuntu8.5`	Not reported	Not reported	Not reported
Ubuntu	libc6-x32	deb	noble	`2.39-0ubuntu8.5`	Not reported	Not reported	Not reported
Ubuntu	locales	deb	noble	`2.39-0ubuntu8.5`	Not reported	Not reported	Not reported
Ubuntu	locales-all	deb	noble	`2.39-0ubuntu8.5`	Not reported	Not reported	Not reported
Ubuntu	nscd	deb	noble	`2.39-0ubuntu8.5`	Not reported	Not reported	Not reported

[Debian bug #1107366]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[glibc-doc]Not affected
Source package: [glibc]
Details (4)
- 2.36-9+deb12u14 · all · bookworm
  Not affected
  usn · glibc · debian · bookworm
- 2.36-9+deb12u14 · all · bookworm
  Not affected
  usn · glibc · debian · bookworm
- 2.36-9+deb12u7 · all · bookworm-security
  Not affected
  usn · glibc · debian · bookworm
- 2.36-9+deb12u7 · all · bookworm-security
  Not affected
  usn · glibc · debian · bookworm
[glibc-source]Not affected
Source package: [glibc]
Details (4)
- 2.36-9+deb12u14 · all · bookworm
  Not affected
  usn · glibc · debian · bookworm
- 2.36-9+deb12u14 · all · bookworm
  Not affected
  usn · glibc · debian · bookworm
- 2.36-9+deb12u7 · all · bookworm-security
  Not affected
  usn · glibc · debian · bookworm
- 2.36-9+deb12u7 · all · bookworm-security
  Not affected
  usn · glibc · debian · bookworm
[libc6]Not affected
Source package: [glibc]
Details (4)
- 2.36-9+deb12u14 · amd64 · bookworm
  Not affected
  usn · glibc · debian · bookworm
- 2.36-9+deb12u14 · arm64 · bookworm
  Not affected
  usn · glibc · debian · bookworm
- 2.36-9+deb12u7 · amd64 · bookworm-security
  Not affected
  usn · glibc · debian · bookworm
- 2.36-9+deb12u7 · arm64 · bookworm-security
  Not affected
  usn · glibc · debian · bookworm
[libc6-dbg]Not affected
Source package: [glibc]
Details (4)
- 2.36-9+deb12u14 · amd64 · bookworm
  Not affected
  usn · glibc · debian · bookworm
- 2.36-9+deb12u14 · arm64 · bookworm
  Not affected
  usn · glibc · debian · bookworm
- 2.36-9+deb12u7 · amd64 · bookworm-security
  Not affected
  usn · glibc · debian · bookworm
- 2.36-9+deb12u7 · arm64 · bookworm-security
  Not affected
  usn · glibc · debian · bookworm
[libc6-dev]Not affected
Source package: [glibc]
Details (4)
- 2.36-9+deb12u14 · amd64 · bookworm
  Not affected
  usn · glibc · debian · bookworm
- 2.36-9+deb12u14 · arm64 · bookworm
  Not affected
  usn · glibc · debian · bookworm
- 2.36-9+deb12u7 · amd64 · bookworm-security
  Not affected
  usn · glibc · debian · bookworm
- 2.36-9+deb12u7 · arm64 · bookworm-security
  Not affected
  usn · glibc · debian · bookworm
[libc6-dev-i386]Not affected
Source package: [glibc]
Details (2)
- 2.36-9+deb12u14 · amd64 · bookworm
  Not affected
  usn · glibc · debian · bookworm
- 2.36-9+deb12u7 · amd64 · bookworm-security
  Not affected
  usn · glibc · debian · bookworm
[libc6-dev-x32]Not affected
Source package: [glibc]
Details (2)
- 2.36-9+deb12u14 · amd64 · bookworm
  Not affected
  usn · glibc · debian · bookworm
- 2.36-9+deb12u7 · amd64 · bookworm-security
  Not affected
  usn · glibc · debian · bookworm
[libc6-i386]Not affected
Source package: [glibc]
Details (2)
- 2.36-9+deb12u14 · amd64 · bookworm
  Not affected
  usn · glibc · debian · bookworm
- 2.36-9+deb12u7 · amd64 · bookworm-security
  Not affected
  usn · glibc · debian · bookworm
[libc6-x32]Not affected
Source package: [glibc]
Details (2)
- 2.36-9+deb12u14 · amd64 · bookworm
  Not affected
  usn · glibc · debian · bookworm
- 2.36-9+deb12u7 · amd64 · bookworm-security
  Not affected
  usn · glibc · debian · bookworm
[libc-bin]Not affected
Source package: [glibc]
Details (4)
- 2.36-9+deb12u14 · amd64 · bookworm
  Not affected
  usn · glibc · debian · bookworm
- 2.36-9+deb12u14 · arm64 · bookworm
  Not affected
  usn · glibc · debian · bookworm
- 2.36-9+deb12u7 · amd64 · bookworm-security
  Not affected
  usn · glibc · debian · bookworm
- 2.36-9+deb12u7 · arm64 · bookworm-security
  Not affected
  usn · glibc · debian · bookworm
[libc-dev-bin]Not affected
Source package: [glibc]
Details (4)
- 2.36-9+deb12u14 · amd64 · bookworm
  Not affected
  usn · glibc · debian · bookworm
- 2.36-9+deb12u14 · arm64 · bookworm
  Not affected
  usn · glibc · debian · bookworm
- 2.36-9+deb12u7 · amd64 · bookworm-security
  Not affected
  usn · glibc · debian · bookworm
- 2.36-9+deb12u7 · arm64 · bookworm-security
  Not affected
  usn · glibc · debian · bookworm
[libc-devtools]Not affected
Source package: [glibc]
Details (4)
- 2.36-9+deb12u14 · amd64 · bookworm
  Not affected
  usn · glibc · debian · bookworm
- 2.36-9+deb12u14 · arm64 · bookworm
  Not affected
  usn · glibc · debian · bookworm
- 2.36-9+deb12u7 · amd64 · bookworm-security
  Not affected
  usn · glibc · debian · bookworm
- 2.36-9+deb12u7 · arm64 · bookworm-security
  Not affected
  usn · glibc · debian · bookworm
[libc-l10n]Not affected
Source package: [glibc]
Details (4)
- 2.36-9+deb12u14 · all · bookworm
  Not affected
  usn · glibc · debian · bookworm
- 2.36-9+deb12u14 · all · bookworm
  Not affected
  usn · glibc · debian · bookworm
- 2.36-9+deb12u7 · all · bookworm-security
  Not affected
  usn · glibc · debian · bookworm
- 2.36-9+deb12u7 · all · bookworm-security
  Not affected
  usn · glibc · debian · bookworm
[locales]Not affected
Source package: [glibc]
Details (4)
- 2.36-9+deb12u14 · all · bookworm
  Not affected
  usn · glibc · debian · bookworm
- 2.36-9+deb12u14 · all · bookworm
  Not affected
  usn · glibc · debian · bookworm
- 2.36-9+deb12u7 · all · bookworm-security
  Not affected
  usn · glibc · debian · bookworm
- 2.36-9+deb12u7 · all · bookworm-security
  Not affected
  usn · glibc · debian · bookworm
[locales-all]Not affected
Source package: [glibc]
Details (4)
- 2.36-9+deb12u14 · amd64 · bookworm
  Not affected
  usn · glibc · debian · bookworm
- 2.36-9+deb12u14 · arm64 · bookworm
  Not affected
  usn · glibc · debian · bookworm
- 2.36-9+deb12u7 · amd64 · bookworm-security
  Not affected
  usn · glibc · debian · bookworm
- 2.36-9+deb12u7 · arm64 · bookworm-security
  Not affected
  usn · glibc · debian · bookworm
[nscd]Not affected
Source package: [glibc]
Details (4)
- 2.36-9+deb12u14 · amd64 · bookworm
  Not affected
  usn · glibc · debian · bookworm
- 2.36-9+deb12u14 · arm64 · bookworm
  Not affected
  usn · glibc · debian · bookworm
- 2.36-9+deb12u7 · amd64 · bookworm-security
  Not affected
  usn · glibc · debian · bookworm
- 2.36-9+deb12u7 · arm64 · bookworm-security
  Not affected
  usn · glibc · debian · bookworm

[Debian 13 (Trixie)]

[glibc-doc]Fixed
Source package: [glibc]
Details (2)
- 2.41-12+deb13u3 · all · trixie
  Fixed · Fixed: 2.41-9
  usn · glibc · debian · 13
- 2.41-12+deb13u3 · all · trixie
  Fixed · Fixed: 2.41-9
  usn · glibc · debian · 13
[glibc-source]Fixed
Source package: [glibc]
Details (2)
- 2.41-12+deb13u3 · all · trixie
  Fixed · Fixed: 2.41-9
  usn · glibc · debian · 13
- 2.41-12+deb13u3 · all · trixie
  Fixed · Fixed: 2.41-9
  usn · glibc · debian · 13
[libc6]Fixed
Source package: [glibc]
Details (2)
- 2.41-12+deb13u3 · amd64 · trixie
  Fixed · Fixed: 2.41-9
  usn · glibc · debian · 13
- 2.41-12+deb13u3 · arm64 · trixie
  Fixed · Fixed: 2.41-9
  usn · glibc · debian · 13
[libc6-dbg]Fixed
Source package: [glibc]
Details (2)
- 2.41-12+deb13u3 · amd64 · trixie
  Fixed · Fixed: 2.41-9
  usn · glibc · debian · 13
- 2.41-12+deb13u3 · arm64 · trixie
  Fixed · Fixed: 2.41-9
  usn · glibc · debian · 13

Next results

Observed: Oct 24, 2026, 10:03:52 PM UTC

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]